How to configure a Tomcat 7 TLS connector for maximum security

I'm trying to configure a Tomcat 7 TLS connector for best possible security. To test, I'm allowing the Qualsys test to run against my server.

However I keep failing on the following points:

• This server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. Grade capped to C
• This server uses RC4 with modern protocols. Grade capped to C.
• The server does not support Forward Secrecy with the reference browsers

Here is my connector configuration:

<Connector port="443"
           maxHttpHeaderSize="16384"
           connectionTimeout="30000"
           enableLookups="false"
           URIEncoding="UTF-8"
           disableUploadTimeout="true"
           server="Java Application"
           SSLEnabled="true"
           scheme="https"
           secure="true"
           sslProtocols="TLSv1,TLSv1.1,TLSv1.2"
           sslProtocol="TLS"
           keystoreFile="./certs/keystore.jks"
           keystorePass="changeit"
           keystoreType="jks"
           keyAlias="devserver.dev.net"
           truststoreFile="./certs/truststore.jks"
           truststorePass="changeit"
           truststoreType="jks"
           clientAuth="false"
     ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
        TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,
        TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA"

/>

I've Googled this to death, but can't find a combination that will resolve the problems found.