We are still having heartbleed issues with one of our servers. We did the update with yum and restarted apache and any service that was using the vulnerable version of openssl. When we test our site to see if it is still vulnerable it says that it is. Our server has apache 2.4.7 compiled from source. Does anyone have any ideas of why it would say that we are still using the vulnerable version of Openssl? If I do a "rpm -qa | grep ssl" I get the following:

  • 3
    You might need to re-compile. – Zoredache Apr 14 '14 at 16:57

There are 2 possibilities:

1) Your compiled version of Apache uses a compiled version of OpenSSL from another location. Just use ldd on the binary of Apache and it shall tell you what OpenSSL shared library it used:

# ldd /usr/sbin/nginx  | grep -i ssl
    libssl.so.10 => /usr/lib64/libssl.so.10 (0x0000003816000000)

If this gives you not output, then it is probably the next possibility.

2) You have OpenSSL statically built into Apache.

In either case, you need to rebuild it.


I believe that you are compiling your apache with static libraries, so you may need to recompile after updating libssl-dev and openssl.

  • While your answer is accurate please try to avoid duplication with previously posted answers. Thanks. :) – Tim Brigham Apr 15 '14 at 16:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.