On top of that, the SSL server supports compression, session tickets and insecure ciphers, so that's three possible attacks to try.

What's REALLY weird: my browser is showing a different cert than OpenSSL is. My browser shows it's signed by PositiveSSL, but when I connect with 'openssl s_client' I get this:

  depth=0 C = --, ST = SomeState, L = SomeCity, O = SomeOrganization, OU = SomeOrganizationalUnit, CN = ip-10-119-98-53, emailAddress = root@ip-10-119-98-53
  verify error:num=18:self signed certificate
  verify return:1
  depth=0 C = --, ST = SomeState, L = SomeCity, O = SomeOrganization, OU = SomeOrganizationalUnit, CN = ip-10-119-98-53, emailAddress = root@ip-10-119-98-53
  verify error:num=10:certificate has expired
  notAfter=Feb 24 01:08:21 2012 GMT
  verify return:1
  depth=0 C = --, ST = SomeState, L = SomeCity, O = SomeOrganization, OU = SomeOrganizationalUnit, CN = ip-10-119-98-53, emailAddress = root@ip-10-119-98-53
  notAfter=Feb 24 01:08:21 2012 GMT

Not only is it self-signed, it's expired. I actually don't know what the fuck is going on here.