What are SSL heartbeats?

apache ssl openssl heartbleed-bug
user193130 picture user193130 · Apr 10, 2014 · Viewed 15.2k times · Source

With all the chatter going on about the heartbleed bug, it's hard to find information on what exactly the exploited heartbeat extension for OpenSSL is used for.

Also, is it possible to disable it for Apache w/ mod_ssl without recompling with the -DOPENSSL_NO_HEARTBEATS flag as suggested @ http://heartbleed.com/?

Answer

pyramids picture pyramids · Apr 10, 2014

Heartbeat is an echo functionality where either side (client or server) requests that a number of bytes of data that it sends to the other side be echoed back. The idea appears to be that this can be used as a keep-alive feature, with the echo functionality presumably meant to allow verifying that both ends continue to correctly handle encryption and decryption. The problem, of course, is that until the recent patch, OpenSSL did not guard against sending back more data than was provided in the first place. I'm not really aware of where the heartbeat extension is actually used in an application since most communication that requires it (e.g. websockets) rely on their own keep-alive features implemented on a higher level.

I can't answer your second question---but it would surprise me if the answer was yes.

Related questions

Unable to establish SSL connection, how do I fix my SSL cert?

I'm trying to wget to my own box, and it can't be an internal address in the wget (so says another developer). When I wget, I get this: wget http://example.com --2013-03-01 15:03:30-- http://example.com/ Resolving …

Read More
Using '-servername' param with openssl s_client

I am installing a new SSL certificate on Centos6/Apache and my web browser keeps picking up the old certificate. To test my setup, I am using "openssl s_client" but I am seeing different results based on the "-servername" …

Read More
client certificates issued by my own CA with Apache

Trying to get an HTTPS session working using client certificates from a self-signed CA. The connection should check that all certificates are valid, both client and server side. The process I followed is roundly as follows: Create Certificate Authority openssl …

Read More