heartbleed are CA private keys compromised?

Question

have any CA private keys such as those used by godaddy to issue private/public key pairs compromised as a result of heartbleed?

Answer 1

The baseline requirements for CAs state:

Key Compromise: A Private Key is said to be compromised if ... there exists a practical technique by which an unauthorized person may discover its value. ...

It also states in section 3.1.5:

The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs:

...

13.The CA is made aware of a possible compromise of the Private Key of the Subordinate CA used for issuing the Certificate;

Any Certificate Authority who stored their private keys that they use for signing on a front-end TLS enabled webserver (that use a vulnerable version of OpenSSL) would be required to revoke any certificates signed by that key or face possible failed audit and subsequent exclusion from trust in browser, etc.

However, there is no reason to believe that the CAs have the keys they use to sign certificates are stored on public facing webservers. In fact, the keys for the root certificates are often stored entirely offline.

As far as front-end webservers' private keys (the keys associated with certificates that are used to authenticate to clients) goes, they may be compromised.

Answer 2

Its very hard to say for sure, but its extremely unlikely for any reputable CA. No CA worth their salt puts their CA certs anywhere near a public facing webserver.