Expire (manually) TLS sessions?

[Jeff Blaine]

Maybe we're doing something wrong in the process, but it
seems that every time we perform offline maintenance
(upgrade, whatever) on Cyrus IMAPd ... our users complain
that TLS breaks afterward, but then fixes itself in time.

I've demonstrated this to myself just now with the upgrade
to 2.3.13 from 2.2.12.  My TLS session is cached but broken
with the new setup (or for whatever other reason).  That is,
even after restarting Thunderbird, I get the following:

Jan 16 06:31:50 imapsrv imap[19690]: [ID 239158 local6.notice] STARTTLS 
negotiation failed: bva-172.our.com

Is there a way to zero/flush all TLS cached sessions?  I
have to imagine there is, but I don't know how.