Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet).

There's a website:

There's a web-based test:

What should I do to protect the sites that I run?

share|improve this question
… as well as the StackExchange for security professionals. See and . – JdeBP Apr 8 '14 at 16:22
Every major SE computer related site now has this question... Probably soon it will be asked even on :D – VL-80 Apr 8 '14 at 19:10
I have added an end-user version of this question at… (but someone has already downvoted it, without explanation). – danorton Apr 8 '14 at 19:10
@Nikolay, now I'm so tempted to ask it on – Joe Apr 8 '14 at 21:30

You should:

  • Update your system to the latest OpenSSL version
  • Generate new keys and certificates for services relying on OpenSSL and restart them
  • Revoke former certificates
  • Invalidate all established sessions
share|improve this answer
I don’t suppose you know of some nice clear instructions for the last three steps, do you? – Paul D. Waite Apr 8 '14 at 17:28
Revoking and regenerating production certificates usually involves whichever process your CA has in place. Since that varies from one CA to the next... – Roger Lipscombe Apr 8 '14 at 17:50
How to update your system depends on your package manager. Invalidating sessions is application-dependent. As for certificates, you'll have to contact your CA but the first step should be to generate a new key and CSR: openssl req -nodes -newkey rsa:4096 -keyout post_heartbleed.key -out post_heartbleed.csr! – Executifs Apr 9 '14 at 8:14

Stolen from a reddit comment.

  1. Update your system:

    sudo apt-get update
    sudo apt-get upgrade
  2. Reboot the server

  3. openssl version -a to make sure you have the latest version!!

share|improve this answer
The OP delivers! – I am John Galt Apr 8 '14 at 17:12
@IamJohnGalt It's not like it's a locked safe or something. ;) – Ƭᴇcʜιᴇ007 Apr 8 '14 at 17:28
This is not sufficient. The SSL keys need to be replaced, without doing that a patch will still leave you vulnerable to past key theft. – Tyrsius Apr 8 '14 at 17:47
This assumes your system uses apt-get as your package manager. The question does not suggest this is necessarily the case. – Michael Apr 9 '14 at 17:12

More specifically for Ubuntu or Debian in general

/etc/init.d/apache2 stop
aptitude update
dpkg -l \*libssl\*
aptitude safe-upgrade libssl1.0.0
dpkg -l \*libssl\*
/etc/init.d/apache2 start


share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .