OpenSSL Heartbleed bug fix for Ubuntu

heartbleedFrom last 2 days, heartbleed bug in OpenSSL is hogging all limelight. Many articles are going lengths to explain what this bug, how it can be exploited. I will not get into it. This is quick post to give a solution.

Solution

Just log in to your server and run:

apt-get update && apt-get upgrade

Then restart nginx (or your webserver). Yes, this is must.

service nginx restart

Mitesh Shah from our team found that unless you restart web-server, heartbleed bug is continue to show up! I am yet to find out why server restart is needed.

Test

You can test if your SSL is vulnerable using – http://filippo.io/Heartbleed/

If your test doesn’t work, let us know.

Anything Else?

If will be good if you rotate, re-issue or re-setup your SSL certificate. Above solution will prevent any further attack. But if your site has been already compromised, then it’s better to generate new private key, car and certificate.

If you are not on Ubuntu, you can just install OS updates and most likely the issue will be fixed.

If your servers are using rtCamp’s managed-hosting, you no need to bother about this. Your servers are secured. You can verify it using above test!