Java Security

In light of the recent findings on client-cert auth https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt, etc.

How can I tell my Java/Tomcat not to use renegotiation?

Any hints would be highly appreciated

See also Eric Rescorla on http://www.educatedguesswork.org/ "The most practical defense on the server side is to restructure the site so that requests which require client auth are redirected to a different address or port which always requests a certificate and itself refuses renegotiation."...

http://www.links.org/?p=780