Yes it affects clients as severly, as stated on the heartbleed website:
Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.
Of course, and this is not just the case for this vulnerability or for a particular client, the client still has to initiate the connection to be attacked. In no way this vulnerability allows an attacker to initiate a connection to your web crawler and exploit the vulnerability.
In your case however, as you have a direct control over the OpenSSL client code (and I suppose this is the case based on your post), you want to ensure that your version of OpenSSL doesn't come with the Heartbeat option, and if it does, to remove it.
To see which options were used to compile your version of OpenSSL, use:
openssl version -o
And In order to compile OpenSSL without Heartbeat supportdo so, simply use this flag when compiling you can:
-DOPENSSL_NO_HEARTBEATS
display which specific options were used to compile your version of OpenSSL :
openssl version -o
or display every information from your OpenSSL version :
openssl version -a
compile OpenSSL without Heartbeat support, by simply using this flag at compile time :
-DOPENSSL_NO_HEARTBEATS
Once this is done, or if your version of OpenSSL didn't include it initially, then you are not vulnerable.
Edit: Another method is to retrieve your OpenSSL version with:
openssl version
And compare it to the list of affected versions available on heartbleed :
- OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
- OpenSSL 1.0.1g is NOT vulnerable
- OpenSSL 1.0.0 branch is NOT vulnerable
- OpenSSL 0.9.8 branch is NOT vulnerable