The time of this writing, the current firmware was 7.2.49.1
To Achieve an A or A+ rating from SSL Labs while using the LoadMaster's SSL acceleration function first requires downloading and applying the latest firmware version. This prevents the latest protocol attacks and addressed critical vulnerabilities. See LoadMaster Release Notes.
The latest firmware can be downloaded from the Downloads section of the KEMP Support site: https://support.kemptechnologies.com/hc/en-us/sections/200428766-Firmware-Downloads.
Note: You must be logged into the Support site in order to see the Downloads section.
In general, there four main components that determine the strength of a given site's SSL implementation: Certificate, Protocol Support, Key Exchange, and Cipher Strength.
Certificates
Ensure that your Certificate has been issued by an Authorized Certificate Authority.
SSL Chain Issues in an SSL Lab report means that there is a missing Intermediate Cert from your LoadMaster . To resolve this chain issue, it requires to upload and apply an Intermediate Cert from your Certificate Authority's (CA) website to your LoadMaster. From more information SSL Certificate Chain Issues.
Steps on how to upload your certificate to the LoadMaster can be found here.
Steps on how to upload your intermediate certificate to the LoadMaster can be found here.
Protocol Support
Disable SSLv3, TLS1.0 and TLS1.1. So now only TLS1.2 and TLS1.3 will be on.
Enable Require SNI Hostname(Recommended)
Key Exchange and Cipher Strength
The BestPractices Cipher Set is the recommended cipher set to use. In your Virtual Service configuration, expand the SSL Properties section and select the BestPractice cipher set.
Refer to the following article for detailed steps on how to enable the BestPractices cipher set: How Do I Enable BestPractices Cipher Set?
Here is the list of ciphers in the BestPractices Cipher Set (as of writing):
1. ECDHE-RSA-AES256-GCM-SHA384
2. ECDHE-ECDSA-AES256-GCM-SHA384
3. DHE-DSS-AES256-GCM-SHA384
4. DHE-RSA-AES256-GCM-SHA384
5. ECDHE-RSA-AES256-SHA384
6. ECDHE-ECDSA-AES256-SHA384
7. ECDHE-RSA-AES256-SHA
8. ECDHE-ECDSA-AES256-SHA
9. DHE-RSA-AES256-SHA256
10. DHE-DSS-AES256-SHA
11. DHE-RSA-AES256-SHA
12. ECDHE-RSA-AES128-GCM-SHA256
13. ECDHE-ECDSA-AES128-GCM-SHA256
14. DHE-RSA-AES128-GCM-SHA256
15. DHE-DSS-AES128-GCM-SHA256
16. ECDHE-RSA-AES128-SHA256
17. ECDHE-ECDSA-AES128-SHA256
18. ECDHE-RSA-AES128-SHA
19. ECDHE-ECDSA-AES128-SHA
20. DHE-RSA-AES128-SHA256
21. DHE-RSA-AES128-SHA
22. DHE-DSS-AES128-SHA256
Note: This list of ciphers provides the greatest compatibility while still maintaining an A rating. However, Windows XP clients using Internet Explorer 6 will not be able to connect. If this is a necessity, re-enable SSLv3.
HSTS (HTTP Strict Transport Security)
To get the 'A+' rating, SSL Labs requires you to be using HSTS. Please refer to this document in order to add HSTS to your Virtual Service: HTTP Strict Transport Security
Good article, but you should include the date published since the reader has no way of knowing how stale the information is.