Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I built an application that generates certificate signing requests (CSRs) using the PHP OpenSSL module.

Is there a way that the HeartBleed bug can affect these (in use) private keys and CSRs that were generated while OpenSSL 1.0.1e was installed on the generating webserver?

share|improve this question
    
Thanks for the edits. –  Elijah Paul Apr 9 at 18:43

1 Answer 1

up vote 9 down vote accepted

The bug only affects TLS connections that enable Heartbeats, not other parts of OpenSSL. Unaffected parts include key generation, certificate signing, generating digests, random bytes generation, etc.

Also, in no way can a certificate be "infected" by this bug such that it carries a risk to other components. For example, certificates generated by OpenSSL 1.0.1g will not be better or worse than ones generated by 1.0.1f (which has the Heartbleed bug).

share|improve this answer
    
Thanks. I guessed as much, but as I'm new to PHP, I was paranoid I might be missing something. –  Elijah Paul Apr 9 at 18:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.