Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are still having heartbleed issues with one of our servers. We did the update with yum and restarted apache and any service that was using the vulnerable version of openssl. When we test our site to see if it is still vulnerable it says that it is. Our server has apache 2.4.7 compiled from source. Does anyone have any ideas of why it would say that we are still using the vulnerable version of Openssl? If I do a "rpm -qa | grep ssl" I get the following:

nss_compat_ossl-0.9.6-1.el6.x86_64 
pyOpenSSL-0.10-2.el6.x86_64 
openssl-1.0.1e-16.el6_5.7.x86_64 
openssl-devel-1.0.1e-16.el6_5.7.x86_64
share|improve this question
3  
You might need to re-compile. –  Zoredache Apr 14 at 16:57
add comment

2 Answers 2

There are 2 possibilities:

1) Your compiled version of Apache uses a compiled version of OpenSSL from another location. Just use ldd on the binary of Apache and it shall tell you what OpenSSL shared library it used:

# ldd /usr/sbin/nginx  | grep -i ssl
    libssl.so.10 => /usr/lib64/libssl.so.10 (0x0000003816000000)

If this gives you not output, then it is probably the next possibility.

2) You have OpenSSL statically built into Apache.

In either case, you need to rebuild it.

share|improve this answer
add comment

I believe that you are compiling your apache with static libraries, so you may need to recompile after updating libssl-dev and openssl.

share|improve this answer
    
While your answer is accurate please try to avoid duplication with previously posted answers. Thanks. :) –  Tim Brigham Apr 15 at 16:25
add comment

protected by Michael Hampton Apr 15 at 16:14

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.