From the write up at https://www.secure-resumption.com/, that appears to be a major limiting factor:

> We have confirmed that our attacks can be mounted on popular web browsers and HTTPS libraries, when they are used to perform certificate-based authentication at servers that enable both resumption and renegotiation.