Protection against Openssl heartbleed issue in salm message transformation

[Peter Schober]

* Rock star <shib.rockstar at gmail.com> [2015-03-26 06:52]:
> We have a java web application which is protected with https. We have used
> openssl to create a "self signing certificate" by using "Openssl - 1.0.1j"
> but recently openssl announced some of(heartbleed) the issues and they
> provided fixes. To skip out from the issues we need to upgrade our openssl
> version at our server side and reissue the certificates as well.

You're two weeks short of being a full year late to react to a
well-publicized remote exploit that would have leaked any and all
information exchanged with affected systems (incl. all passwords).
As such bear with me if I don't take any of that too seriously.

Also Java as server process wasn't affected, as Java does not use openssl.

> The above procedure is fine for browser facing on https port
> 443. but here we are using the public key in idp-metadata.xml under
> <ds:X509Certificate> element. the key is created by using openssl
> version 1.0.1j. I think we need to reissue the certificate again by
> using new openssl version to protect idp and sp communication at
> message level.

The issue you're referring to was about the TLS protocol, not about a
bug that affected the creation of key material.

> 1) We need to reissue the certificate. Please let me know if i am wrong?

Check the archives for discussions on conditions where this was necessary.

> 2) Is there any procedure to migrate the certificate in the metadata?

Sure, though if you've been exposed for a whole year I don't think
that matters much now.
The documentation has all the details, of course.
-peter