They're using the Amazon Linux AMI (2014.09 most likely). It might be the default Apache config that ships with it, since it's super terrible. The F could be ea

They're using the Amazon Linux AMI (2014.09 most likely). It might be the default Apache config that ships with it, since it's super terrible. The F could be easily fixed with a slightly revised cipher suite list, but it would still be pretty low from all of the other problems.