The ckch instance keeps a reference to its SSL_CTX since commit 358a822
("BUG/MINOR: ssl: Fix update of default certificate") but this instance
was not freed during the instance's deletion.
It can be backported as far as 2.2 and where 358a822 is backported.