Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a series of cloud servers running JBoss AS 6.1.0 community edition. We restrict access to these systems using SSL. We generate an SSL certificate for each server and then manually distribute it to personnel that require access. The server is its own certificate authority. The cert is not being used to identify the server to users, but to identify users to the server.

Anyway, the point: is JBoss AS 6.1.0 vulnerable to Heartbleed? We use openssl to generate the keys, but from what I understand JBoss AS uses Tomcat/Coyote to do its https stuff. Do they use the OpenSSL library? How can I patch this component of JBoss specifically, if it is a problem? Unfortunately, upgrading JBoss version is not an option.

share|improve this question
You can find good explanation here :… – user130370 Apr 9 '14 at 6:56
up vote 1 down vote accepted

Java implements its own stack of SSL/TLS and does not relay on the OpenSSL or any other SSL implementation library. JBoss is written completely in Java so the answer is no, JBoss is not affected by the Heart Bleed vulnerability.

share|improve this answer
It depends if your Java/JBoss has Apache Portable Runtime (APR) in use. This answer is correct when you don't use APR. Some JBoss versions come with APR all setup to run out of the box so it is possible you are already using APR without knowing it. Please read the comment attached to the question referencing – Darryl Miles Apr 10 '14 at 7:37

It has nothing to do with JBoss. You just need to upgrade your openssl to v1.0.1g or fall back to v.98. Highly likely they are using TLS with OpenSSL.

share|improve this answer
This advice is not worded well, many users of JBoss products will be using Red Hat 6 and there is no 1.0.1g update for RH6, instead you would install 1.0.1e-16 or later (despite this looking like it is within the affected version range it has been patched) see – Darryl Miles Apr 10 '14 at 7:43
Use "rpm -q openssl" to see what version you have installed. Versions 1.0.0 and 0.9.x are not affected the vulnerable TLS feature was only added in 1.0.1 (see for more info on versions and OS) – Darryl Miles Apr 10 '14 at 7:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.