Are new SSL Certificates after patching Heartbleed?

Question

We've upgraded our servers and regenerated any cpanel / dovecot / ssh keys. do our customers also need to regenerate a CSR and SSL certificates?

I've not seen any information on this aspect of things.

Thanks

Answer 1

According to this thread on Unix/Linux SE,

How do I fix the vulnerability?
...
Generate new keys. This is necessary because the bug might have allowed an attacker to obtain the old private key. Follow the same procedure you used initially.

And this answer on Security SE:

It means much more than just new certificates (or rather, new key pairs) for every affected server.
...
Summarized from heartbleed.com (emphasis mine):
...
What is leaked primary key material and how to recover?

These are the crown jewels, the encryption keys themselves.

And this thread on Serverfault SE:

As noted on the Heartbleed site, appropriate reponse steps are broadly:

1. Patch vulnerable systems.
2. Regenerate new private keys.
3. Submit new CSR to your CA.
4. Obtain and install new signed certificate.
5. Revoke old certificates.

So yes, I strongly suggest you change any and all keys/certificates. I also recommend reading those threads in their entirety as well as some of the threads they reference. There's quite a bit of information on the bug spread across Security and Serverfault SEs.

Answer 2

With Heartbleed it is possible to retrieve the private keys.

So, if you have been vulnerable, yes, it is strongly recommended that your customers change their private keys.