##

### Introduction

Historically there have been security issues associated with TLS renegotiation. This page describes the renegotiation behaviour of the Tomcat Native library.

### Client initiated renegotiation

Client initiated renegotiation is disabled. This behaviour is hard-coded and cannot be changed.

### Unsafe legacy negotiation

Support for unsafe legacy negotiation depends on OpenSSL. Unsafe legacy renegotiation is disabled by default and will not be allowed unless the OpenSSL configuration option `SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION` is set.