[DoubleMalt]

This is actually not enough as you cannot be sure that certificates generated after that have never been used on a server with a vulnerable OpenSSL implementation.

[throwaway125]

You can't ever guarantee that for any certificate signed by any CA.