After fighting for a few hours with Nginx to ‘improve’ the Key Exchange and Cipher Strength ratings, I’m in the same place.
https://www.ssllabs.com/ssltest/analyze.html?d=eapl.mx&latest

At least I found how Let’s Encrypt is interacting with Nginx for the ‘recommended’ settings. Next step is https://observatory.mozilla.org