Note that disabling SSL_RENEGO doesn't open door for renego attack
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 47c7196..69e997f 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -1155,6 +1155,13 @@
* misuse/misunderstand.
*
* Comment this to disable support for renegotiation.
+ *
+ * \note Even if this option is disabled, both client and server are aware
+ * of the Renegotiation Indication Extension (RFC 5746) used to
+ * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1).
+ * (See \c mbedtls_ssl_conf_legacy_renegotiation for the
+ * configuration of this extension).
+ *
*/
#define MBEDTLS_SSL_RENEGOTIATION