<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000'>If you are using the native SP, which has process/privilege separation from the web server, I would not worry about replacing the SP
keys. The vulnerability should only have exposed memory accessible to the httpd process. If you were using something like simpleSAMLphp then there could possibly be some concern.<br><br>I would replace your public-facing SSL keys/certificates if I were you. That's relatively easy. Consider invalidating any especially long-lived cookies. Maybe change internal admin passwords too, if they could have touched httpd processes also reachable by the public. Attack a server that's still vulnerable and see what you can see.<br></div></body></html>