8

I built an application that generates certificate signing requests (CSRs) using the PHP OpenSSL module.

Is there a way that the HeartBleed bug can affect these (in use) private keys and CSRs that were generated while OpenSSL 1.0.1e was installed on the generating webserver?

0

1 Answer 1

11

The bug only affects TLS connections that enable Heartbeats, not other parts of OpenSSL. Unaffected parts include key generation, certificate signing, generating digests, random bytes generation, etc.

Also, in no way can a certificate be "infected" by this bug such that it carries a risk to other components. For example, certificates generated by OpenSSL 1.0.1g will not be better or worse than ones generated by 1.0.1f (which has the Heartbleed bug).

1
  • Thanks. I guessed as much, but as I'm new to PHP, I was paranoid I might be missing something. Commented Apr 9, 2014 at 18:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .