mrsaint

Well, TLS-auth should be used _on top_ of a PKI. It is a HMAC key that an attacker would need to know before he'd even be able to initiate a TLS handshake.

Thus, if you have used it in your OpenVPN setup, and if you know that the few users who have access to your VPN wouldn't have heartbleed-attacked you, then yes, you could assume that your private key has been safe from heartbleed despite an exploitable OpenSSL library.

To reissue a cert without revoking the previous one is like a half-baked cake. Actually, more like a cake that was never placed in the oven - a complete mess of runny eggs with dry flour and inedible. As long as they don't revoke the cert, the attacker could still use it along with its private key (which they potentially stole from you) to do an MITM attack.

It doesn't make sense.

What if a party is harmed by the compromised certificate? Legally whose fault is it if the CA replaced the compromised certificate but failed to revoke it as well?