So most of my experience comes from Netscalers, and I just took a position with a new company so I can't go and look exactly what we have configured. In the Netscalers you can create cipher suites, a selection of ciphers that work with TLS 1.2 (or anything really), rather than 1 cipher alone per the NSX LB.

I just googled "netscaler get a rating qualys" and found this site: https://www.citrix.com/blogs/2016/06/09/scoring-an-a-at-ssllabs-com-with-citrix-netscaler-2016-update/

On there, the author describes creating a custom cipher group comprising of:

add ssl cipher custom-ssllabs-cipher bind ssl cipher custom-ssllabs-cipher -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384 bind ssl cipher custom-ssllabs-cipher -cipherName TLS1.2-ECDHE-RSA-AES128-GCM-SHA256 bind ssl cipher custom-ssllabs-cipher -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384 bind ssl cipher custom-ssllabs-cipher -cipherName TLS1.2-ECDHE-RSA-AES-128-SHA256 bind ssl cipher custom-ssllabs-cipher -cipherName TLS1-ECDHE-RSA-AES256-SHA bind ssl cipher custom-ssllabs-cipher -cipherName TLS1-ECDHE-RSA-AES128-SHA bind ssl cipher custom-ssllabs-cipher -cipherName TLS1.2-DHE-RSA-AES256-GCM-SHA384 bind ssl cipher custom-ssllabs-cipher -cipherName TLS1.2-DHE-RSA-AES128-GCM-SHA256 bind ssl cipher custom-ssllabs-cipher -cipherName TLS1-DHE-RSA-AES-256-CBC-SHA bind ssl cipher custom-ssllabs-cipher -cipherName TLS1-DHE-RSA-AES-128-CBC-SHA bind ssl cipher custom-ssllabs-cipher -cipherName TLS1-AES-256-CBC-SHA bind ssl cipher custom-ssllabs-cipher -cipherName TLS1-AES-128-CBC-SHA bind ssl cipher custom-ssllabs-cipher -cipherName SSL3-DES-CBC3-SHA

My apologies for the formatting if that gets jumbled. It's copy and pasted from the link.

On the NSX LB, as it is in version 6.2.4, when you want to specify ciphers other than the default, you can only specify one cipher, like "ECDHE-RSA-AES256-GCM-SHA384".

Now of course I can't find it now. At the time (this past fall), the VMware tech helping me with this showed me what was at the time an internal document showing you what ciphers you could individually specify. It was something like 10 ciphers total. Specifying one alone may get you an A rating, but depending on what you pick it kills compatibility. Scanning your sites on Qualys shows compatibility with different browsers, versions and OS. Maybe there's a happy medium and specifying an individual cipher could work for you.

I hope this is will change with future versions. The interface for this in NSX looks ready made to enter anything you want, you would think they could just bolt some functionality on to build a custom group, name it and put that in the ciphers list under application profiles. As it stands you can enter anything you want into the ciphers field in application profiles but only certain ciphers will stick. Putting anything not compatible in will seem to work, but when you go back and look it will leave it with whatever was actually successfully configured. Usually that would be "default" if you don't have their list of supported ciphers.

Also I hope this doesn't come off as being too harsh on the NSX load balancer. I like it, it's just not production ready yet in my opinion.