I confirm that the module always tries to make a new encrypted connection (using Net::SSLeay module) to the address/port indicated on the passive response.