I did forget to mention, thanks for this article! This is a gaping hole in the current documentation!

One more question:

Besides dropping the certificate and restarting the server while I cross my fingers, is there any way to CONFIRM that all of the encrypted bits are gone from a log file after following the steps as you've provided them?

I'd hate to think I'd taken care of the problem when there really were some leftover encrypted pieces in the log file.

Thanks!