[ef4]

What that tool says is irrelevant to the question of whether those certs have been compromised.

The risk is that before the vulnerability was patched, somebody used it to grab the private keys associated with the certs.

[singlow]

But what if the key was never used with openssl or heartbeat?

[andreasvc]

Obviously that would be great, but a tool cannot check that.