Renegotiation is used in cases where you want to change the rules of the SSL/TLS session after data has been sent in the channel. One common use case for this

Renegotiation is used in cases where you want to change the rules of the SSL/TLS session after data has been sent in the channel. One common use case for this is to require TLS client certificates for only SOME resources. The TLS/SSL server initially does not advertise any acceptable CAs for client certificates, but once a resource that requires a TLS client certificate is requested then renegotiation is done providing the resource-specific list of acceptable CAs for which a client certificate would be acceptable to provide access to the resource.