At present s2n has a single fixed ordering for cipher suites. These defaults should suit most users, but some flexibility is probably necessary.

Tentative proposal for an API:

s2n_config_set_cipher_preferences(config, "AES128 > 3DES > RC4", &err);
s2n_config_set_exchange_preferences(config, "DHE > RSA", &err);