Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Due to heartbleed vulnerability I have recompiled apache with non vulnerable latest openssl(I had to keep old vulnerable openssl due to some dependency problem). It is running fine and when doing heartbleed test for it says 'seems fixed or unaffected'. But if I do apachectl graceful and take test for heartbleed it says is vulnerable. If I do /usr/local/etc/rc.d/apache2 restart or apachectl restart there is no problem.

1)My question is why it takes old openssl library when doing apachectl graceful only?

2)What is the difference between apachectl restart and apachectl graceful when accessing openssl libraries?

share|improve this question
up vote 3 down vote accepted

There is no difference between apachectl restart and graceful in terms of loading libraries. apachectl graceful sends the SIGUSR1 signal instead of SIGTERM so that open connections have the oppurtunity to close instead of being interrupted. see apachectl man page

You may have 2 installations of apache on your system. If apache was installed through your package manager and you didn't remove it before you recompiled then that could explain the bizarre test results. You could be starting apache with /usr/local/etc/rc.d/apache2 restart which would start your recompiled instance. Then when you used apachectl which is really /usr/sbin/apachectl it started your vulnerable installation and you failed the check.

share|improve this answer
Wrong. apachectl restart start new version (non vulnerable), but apachectl graceful is vulnerable. – Harikrishnan Apr 26 '14 at 10:53
@Harikrishnan when apache fails the test, if you run ps aux | egrep "(httpd|apache)" is your new binary is what is shown by ps? – Creek Apr 26 '14 at 11:53's new binary but with old openssl.(Old binary is moved from default path) – Harikrishnan Apr 26 '14 at 16:36
In your httpd.conf, does LoadModule ssl_module [path to module] point to the new module? – Creek Apr 26 '14 at 19:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.