8

I built an application that generates certificate signing requests (CSRs) using the PHP OpenSSL module.

Is there a way that the HeartBleed bug can affect these (in use) private keys and CSRs that were generated while OpenSSL 1.0.1e was installed on the generating webserver?

Improve this question
0

1 Answer 1

Reset to default
11

The bug only affects TLS connections that enable Heartbeats, not other parts of OpenSSL. Unaffected parts include key generation, certificate signing, generating digests, random bytes generation, etc.

Also, in no way can a certificate be "infected" by this bug such that it carries a risk to other components. For example, certificates generated by OpenSSL 1.0.1g will not be better or worse than ones generated by 1.0.1f (which has the Heartbleed bug).

Improve this answer
1
  • Thanks. I guessed as much, but as I'm new to PHP, I was paranoid I might be missing something.
    – Elijah Paul
    Apr 9, 2014 at 18:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .