Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've seen a couple of questions related to this, but none that specifically answers the question of what the risk is in the event that SSL termination is done downstream of the app on Nginx?

Scenario is fairly standard - Nginx runs on the perimeter, does SSL termination, acts as reverse proxy to static content, and forwards requests upstream to our app, which is running on a separate server.

Heartbleed, AFAIK, leaks data from the server running OpenSSL, which in our case is Nginx. Ignoring the issue of leaking private keys, which is clearly a problem, what other information could be harvested from the Nginx process?

share|improve this question

marked as duplicate by MadHatter, dawud, Tim Brigham, voretaq7 Apr 15 at 16:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Anything that is in the memory of the nginx process can be leaked including recent requests containing passwords/CC numbers, responses containing sensitive application data. –  Lekensteyn Apr 15 at 8:33
possible duplicate of Is the danger of the heartbleed bug worse than using non-ssl connections? - the questions aren't the same, but the answers to the earlier one pretty comprehensively answer this, too. –  MadHatter Apr 15 at 8:36
serverfault.com/a/588299/9517 –  Iain Apr 15 at 8:56

Browse other questions tagged or ask your own question.