diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig
index 77a92287c8a..afbd66368f0 100644
--- a/components/mbedtls/Kconfig
+++ b/components/mbedtls/Kconfig
@@ -771,7 +771,7 @@ menu "mbedTLS"
 
     config MBEDTLS_SSL_RENEGOTIATION
         bool "Support TLS renegotiation"
-        depends on MBEDTLS_TLS_ENABLED
+        depends on MBEDTLS_TLS_ENABLED && MBEDTLS_SSL_PROTO_TLS1_2
         default y
         help
             The two main uses of renegotiation are (1) refresh keys on long-lived
diff --git a/examples/protocols/esp_http_client/sdkconfig.ci.tls13_only b/examples/protocols/esp_http_client/sdkconfig.ci.tls13_only
new file mode 100644
index 00000000000..9b2a9ba5582
--- /dev/null
+++ b/examples/protocols/esp_http_client/sdkconfig.ci.tls13_only
@@ -0,0 +1,14 @@
+CONFIG_EXAMPLE_CONNECT_ETHERNET=y
+CONFIG_EXAMPLE_CONNECT_WIFI=n
+CONFIG_EXAMPLE_USE_INTERNAL_ETHERNET=y
+CONFIG_EXAMPLE_ETH_PHY_IP101=y
+CONFIG_EXAMPLE_ETH_MDC_GPIO=23
+CONFIG_EXAMPLE_ETH_MDIO_GPIO=18
+CONFIG_EXAMPLE_ETH_PHY_RST_GPIO=5
+CONFIG_EXAMPLE_ETH_PHY_ADDR=1
+CONFIG_EXAMPLE_CONNECT_IPV6=y
+CONFIG_ESP_HTTP_CLIENT_ENABLE_BASIC_AUTH=y
+CONFIG_ESP_HTTP_CLIENT_ENABLE_DIGEST_AUTH=y
+CONFIG_EXAMPLE_HTTP_ENDPOINT="httpbin.espressif.cn"
+CONFIG_MBEDTLS_SSL_PROTO_TLS1_2=n
+CONFIG_MBEDTLS_SSL_PROTO_TLS1_3=y