The SSL test tells me "The server does not support Forward Secrecy with the reference browsers. Grade reduced to A-."
Looking through the table, the only one my server doesn't support Forward Secrecy with is "Win Phone 8.1":
|IE 11 / Win Phone 8.1 R||RSA 2048 (SHA256)||TLS 1.2 > http/1.1||TLS_RSA_WITH_AES_128_CBC_SHA256 No FS|
|IE 11 / Win Phone 8.1 Update R||RSA 2048 (SHA256)||TLS 1.2 > http/1.1||TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 ECDH secp256r1 FS|
But it does support "Win Phone 8.1 Update". What makes a browser "reference"? I'm not familiar with those browsers, but from the names, sounds like the latter obsoletes the former...