Renegotiation is necessary to update expired credentials, but it can also be called anytime aclient requests an update. While it was intended to give flexibility, attackers can misuse it to overload the server. Disabling this function is essential to prevent attacks.