We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries.
It appears that OpenSSL has vulnerabilities resolved on a regular basis. This makes me wonder if I should move the SSL layer to a separate Java process / something more proven, that will not have buffer overflow, and other vulnerabilities.
There would of course be a delay between discovery->release->compilation->distribution to the servers running. And additional administration cost/delay in the event there is a problem with the build.
- How effective will prompt updates be against attackers? What kind of work would be necessary for the attacker, once a vulnerability is identified?
- Do you recommend an alternative, more secure approach to installing the https layer?
- Is there an older, more stable version of OpenSSL that is still maintained, and had a longer time to be proven secure?
Any input would be appreciated, including help with getting this question right.
Edit: A couple clarifications on how a separate library would be introduced, if that was to happen: The separate library would just be an implementation of a proxy https server, in a separate process. This is a brand-new implementation, so we wouldn't be switching, we would instead just 'not use' the Node.JS
https server library.