ssl::renegotiate changes SSL session ID and makes it impossible to resume?

im doing the usual requesting a client certificate from the irule without having the put the ssl client side profile on request.

 

 

because of the failure to request the new SSL session id certain tcp session are using a different SSL session id which isn't authorized within the irule to access the protected resources.

 

 

this can be solved with using a cookie, but i just want to understand why the F5 doesn't honor the request for an, in my opinion, valid SSL session id.