We have a series of cloud servers running JBoss AS 6.1.0 community edition. We restrict access to these systems using SSL. We generate an SSL certificate for each server and then manually distribute it to personnel that require access. The server is its own certificate authority. The cert is not being used to identify the server to users, but to identify users to the server.
Anyway, the point: is JBoss AS 6.1.0 vulnerable to Heartbleed? We use openssl to generate the keys, but from what I understand JBoss AS uses Tomcat/Coyote to do its https stuff. Do they use the OpenSSL library? How can I patch this component of JBoss specifically, if it is a problem? Unfortunately, upgrading JBoss version is not an option.