To get working session keys embedding and description required to record TLS connection from start (TCP SYN/ACK). If TLS connection is long-term and the start of the connection not recorded, then traffic cannot be decrypted.
From my point view, need to try utilize `SSL_key_update()` with `SSL_KEY_UPDATE_REQUESTED`. [More info](https://www.openssl.org/docs/man1.1.1/man3/SSL_renegotiate.html).