[gentoo-user] Heartbleed fix - question re: replacing self-signed certs with real ones

[Tanstaafl]

Hi all,

I've taken this opportunity to prod the boss to let me buy some real 
certs for our few self-hosted mail services. Until now, we've used 
self-signed certs.

My question is, what exactly is the correct procedure for doing this?

Also, do I still need to do the step I've been seeing:

Step: 2

Delete SSL key set

     Now, make out a list of websites that are equipped with SSL
     certificates.
     After that, delete all SSL keys, private and CSR key
     Finally, create a new private key and CSR key for each of your
     website. However, remember that your keys should be of 2048-bit key
     length.

?

Or will simply replacing my self-signed certs with the new real ones be 
good enough?

Thanks