Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've updated my Ubuntu server to use OpenSSL 1.0.1g and when I run sudo openssl version -a I get OpenSSL 1.0.1g 7 Apr 2014 built on: Sat Apr 19 14:15:45 UTC 2014 platform: linux-elf

However, sites like are still returning my site as vulnerable to Heartbleed. I have restarted the server, not sure what else I have to do.

Is there a way to find any services that are currently running and are vulnerable to the Hearbleed security issue?

Anyone else having this problem?

share|improve this question
What are you using to terminate SSL? Apache, nginx, pound, stunnel, etc.? Could it be that you have a custom build of one of these which is statically linked? – chrskly Apr 19 '14 at 14:52
Why did you build your own instead of using the Ubuntu-provided security update? – Michael Hampton Apr 19 '14 at 15:37
Did you also update libssl? – EEAA Apr 19 '14 at 17:30
up vote 1 down vote accepted

I can think of a few problems that would cause this:

  1. Possibly some form of a caching issue, not sure if you have any caching enabled on your sites, but I would look there.
  2. Apache being built on an older OpenSSL version. In this case you need to recompile it, or depending on OS use yum/apt-get to remove it and reinstall it.
  3. Did you remember to restart Apache after making the change to OpenSSL?

If you provide more details I may be able to assist further.

share|improve this answer
#2 It was running an old version of Apache that wasn't recognizing the updated OpenSSL version. All is set now. Thanks :) – Brian Weinreich Apr 20 '14 at 19:42

Heartbleed can be exploited if you have a service running, that is actively using a vulnerable openssl version.

This could be a service providing https. After fixing the openssl-stack (like you tried to do) and after verifying the service (like you did) the last step, after you are not vulnerable any longer, is to treat all involved keys as compromised.

That is: Mark them as compromised and get new ones.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.