diff --git a/ca/client.go b/ca/client.go
index 7d0fd5176..d98de5f2a 100644
--- a/ca/client.go
+++ b/ca/client.go
@@ -80,6 +80,10 @@ func (c *uaClient) SetTransport(tr http.RoundTripper) {
 	c.Client.Transport = tr
 }
 
+func (c *uaClient) CloseIdleConnections() {
+	c.Client.CloseIdleConnections()
+}
+
 func (c *uaClient) Get(u string) (*http.Response, error) {
 	return c.GetWithContext(context.Background(), u)
 }
@@ -639,6 +643,13 @@ func (c *Client) SetTransport(tr http.RoundTripper) {
 	c.client.SetTransport(tr)
 }
 
+// CloseIdleConnections closes any connections on its Transport which were
+// previously connected from previous requests but are now sitting idle in a
+// "keep-alive" state. It does not interrupt any connections currently in use.
+func (c *Client) CloseIdleConnections() {
+	c.client.CloseIdleConnections()
+}
+
 // Version performs the version request to the CA with an empty context and returns the
 // api.VersionResponse struct.
 func (c *Client) Version() (*api.VersionResponse, error) {
diff --git a/ca/tls.go b/ca/tls.go
index b563740b0..8c30cf332 100644
--- a/ca/tls.go
+++ b/ca/tls.go
@@ -367,6 +367,9 @@ func getPEM(i interface{}) ([]byte, error) {
 
 func getRenewFunc(ctx *TLSOptionCtx, client *Client, tr *http.Transport, pk crypto.PrivateKey) RenewFunc {
 	return func() (*tls.Certificate, error) {
+		// Close connections in keep-alive state
+		defer client.CloseIdleConnections()
+
 		// Get updated list of roots
 		if err := ctx.applyRenew(); err != nil {
 			return nil, err