I built an application that generates certificate signing requests (CSRs) using the PHP OpenSSL module.

Is there a way that the HeartBleed bug can affect these (in use) private keys and CSRs that were generated while OpenSSL 1.0.1e was installed on the generating webserver?


The bug only affects TLS connections that enable Heartbeats, not other parts of OpenSSL. Unaffected parts include key generation, certificate signing, generating digests, random bytes generation, etc.

Also, in no way can a certificate be "infected" by this bug such that it carries a risk to other components. For example, certificates generated by OpenSSL 1.0.1g will not be better or worse than ones generated by 1.0.1f (which has the Heartbleed bug).

  • Thanks. I guessed as much, but as I'm new to PHP, I was paranoid I might be missing something. Apr 9 '14 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.