mitigating the TLS client-initiated renegotiation MITM attack

Any rule you have *must* prevent renegotiation. If you have completed the renegotiation, the attack has already been successful, at least against the HTTP protocol. The reason is that the server buffers the client request, which is malicious coming from the man-in-the-middle (MiTM). Once renegotiation completes, the server executes the buffered request, which means game over.

 

 

So to be truly protected, you need to drop the actual renegotiation attempt. This is why netsekure.org reports you are vulnerable.