It&#39;s not a decision. If you were running a vulnerable version for any amount of time then revoking and reissuing keys and�Certs after you patch is the only way to ensure someone doesn&#39;t have your private key material.�<div>
<br></div><div>You must patch,�revoke��AND�reissue.�</div><div>If you are a public site and don&#39;t do this then you are placing your future�<span></span>client data at risk.�<br><br>On Wednesday, April 9, 2014, Steve Holdoway &lt;<a href="mailto:steve@greengecko.co.nz">steve@greengecko.co.nz</a>&gt; wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Wed, 2014-04-09 at 13:21 +1200, Dean Pemberton wrote:<br>
<br>
[snip]<br>
<br>
<a href="http://filippo.io/Heartbleed" target="_blank">http://filippo.io/Heartbleed</a> provides a quick and dirty tester, if you<br>
want to optimize ssl usage, then <a href="https://www.ssllabs.com/ssltest" target="_blank">https://www.ssllabs.com/ssltest</a> is far<br>
more thorough.<br>
<br>
Most of my sites are CentOS 6 or Amazon linux. With both of these, a<br>
<br>
yum update openssl\*<br>
<br>
followed by restarting your web server implements the fix.<br>
<br>
You still have the decision as to whether to revoke and replace the<br>
current cert though...<br>
<br>
<br>
Steve<br>
--<br>
Steve Holdoway BSc(Hons) MIITP<br>
<a href="http://www.greengecko.co.nz" target="_blank">http://www.greengecko.co.nz</a><br>
Linkedin: <a href="http://www.linkedin.com/in/steveholdoway" target="_blank">http://www.linkedin.com/in/steveholdoway</a><br>
Skype: sholdowa<br>
<br>
_______________________________________________<br>
NZNOG mailing list<br>
<a href="javascript:;" onclick="_e(event, &#39;cvml&#39;, &#39;NZNOG@list.waikato.ac.nz&#39;)">NZNOG@list.waikato.ac.nz</a><br>
<a href="http://list.waikato.ac.nz/mailman/listinfo/nznog" target="_blank">http://list.waikato.ac.nz/mailman/listinfo/nznog</a><br>
</blockquote></div>