Installing the Heartbleed fix (openssl 1.0.1e-2+deb7u6) on a box that uses openswan 1:2.6.37-3+deb7u1 breaks all tunnels. Openswan +deb7u1 version is a security update released in 2013. Falling back to the vanilla Wheezy version allows the tunnels to be reestablished (if you can live with the vulnerability +deb7u1 patched.)

I have not been able to get to the very bottom yet. It is possible something in the IPSec config no longer pass muster, or that another update is playing into this. The only visible symptom is that both ends suddenly reject each others certificates with an INVALID_ID_INFORMATION error.