Home / server / Questions / 587688
Accepted
Eduard Florinescu
Asked: 2014-04-10 00:57:49 +0800 CST

How can I check if my embedded Linux's SSL is not affected by heartbleed, without relying on the version number?

  • 772

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get:

openssl version -a

gets -»

OpenSSL 1.0.0k 5 Feb 2013

But this maybe patched or merged and I don't have access to the sources, how can I check that my system is not vulnerable without relying on openssl version -a

security

2 Answers

  1. Best Answer

    There is a perl script that allows you to check our own services. There are also online tools. One more.

    • 3

  2. Qualys SSL Labs has a very good SSL Test, which features Heartbleed tests as well, and generally servers as a good point in testing your own SSL Infrastructure for stuff like Forward Secrecy, BEAST Attacks, weak protocols and whatnot. And it's free.

    https://www.ssllabs.com/ssltest/

    • 1