In production we recommend that a server is shut down with "lame duck mode"
as a graceful way to slowly evict clients. With large deployments this
mitigates the "thundering herd" situation that will place CPU pressure on
servers as TLS enabled clients reconnect.

After entering lame duck mode, the server will stop accepting new
connections, wait for a 10 second grace period, then begin to evict clients
over a period of time configurable by the configuration option. This
period defaults to 2 minutes.