IO::Socket::SSL has an option to close that force-frees the SSL context (vgrep for "ctx"). Is that good enough, or do you need to keep the socket but get a new session on top of it? I'm not an expert, but it would seem that if you're renegotiating crypto then also tearing down and building a new TCP connection shouldn't be to bad.