Symptom:
Since the ASR fails to send MM6 [being a responder] in the absence of a valid certificate, IKE SAs start leaking and hence get stuck in MM_KEY_EXCH state. Multiple MM_KEY_EXCH exist for a single Peer on the ASR, however the Peer does not retain any SAs for ASR in this case.
Along with CAC for in-negotiation IKE SAs, these stuck SAs block any new SAs or IKE rekeys even after renewing the certificates on the ASR.

Conditions:
This symptom is observed under the following conditions:
- ASR acting as IKEv1 termination point [sVTI for example] and is a responder.
- IKE authentication mode is RSA-SIG [Certificates]. 
- On the ASR, the ID-Certificate is either Expired or Not-present for a given sVTI tunnel
- The ASR also has a IKE in-negotiation CAC of a certain value.
Example:
  crypto call admission limit ike in-negotiation-sa 30