I'm trying to understand the implications of private key leakage (due to Heartbleed) from a website that uses a wildcard certificate.
If an organization has a wildcard certificate (valid for *.domain.tld), does it mean that all sites that use this certificate will have to share the same private key?