The default is apparently "Connection: keep-alive", which somehow keeps the socket around, which leaks file descriptors with every connection that fetches OCSP and/or CRLs. Over time that could result in the number of FDs reaching a limit e.g. imposed by FD_SET(). Closes strongswan/strongswan#1160