Well after groveling around trying to find documentation on the right way to configure TLS, I came up with

• NIST guidelines (thanks Wikipedia)
• TLS Recommendations BCP (draft)

Just stashing these link here for next time …