Our vulnerability scanner (Saint-based) is claiming that a large number of devices and servers are susceptible to the SSL/TLS renegotiation flaw (CVE-2009-3555). Most of these servers and devices are fairly up-to-date on patches / firmware.
Since the issue is 5+ years old, I suspect that the issues reported are mainly false positives.
To verify, I ran this:
openssl s_client -connect x.x.x.x:443 <snip> GET / HTTP/1.1 R RENEGOTIATING depth=0 CN = X.X.X.X, L = Utopia, ST = UU, C = US, O = Acme, OU = IT verify error:num=18:self signed certificate verify return:1 depth=0 CN = X.X.X.X, L = Utopia, ST = UU, C = US, O = Acme, OU = IT verify return:1 read:errno=0 (CRLF)
So the server is saying, "RENEGOTIATING", which seems to indicate that it is vulnerable but it does not deliver content upon the subsequent CRLF, which seems to indicate that it is not vulnerable.
Based on the above, is this device vulnerable? Is there a better way to test? I just need a reliable way to confirm before writing off as false positive or trying to find a fix.