OpenSSL Heartbleed Check

Due to inactivity this scanner has been taken down.

Due to inactivity this scanner has been taken down.

This page accesses the heartbleed-check web API provided by the Texas A&M Computer Engineering and Systems Group. It checks if your browser responds to invalid heartbeat packets. As of when this page was created Firefox, Chrome, and Internet Explorer are not vulnerable and do not link to OpenSSL. You can use the command line options provided below to check if your server is running a vulnerable version of OpenSSL. Rekonq and CURL are two examples of http clients which link to OpenSSL and might be vulnerable to the heartbleed bug.

Vulnerability status: …contacting server…

Interpreting the results:

  • If you receive “There was an error contacting the server!” either there were too many requests to the server at that time, or your browser does not support TLS.
  • If you receive “not vulnerable (timeout)” it means your browser did not reply to the heartbeat. This is typically because either you are running a patched version of OpenSSL or your application uses a different implementation of OpenSSL.
  • If you receive “not vulnerable (heartbeats disabled)” it means your browser has heartbeats disabled. This is typically because either you are running a patched version of OpenSSL or your application uses a different implementation of OpenSSL.
  • If you receive “vulnerable” you should update your OpenSSL library to the newest version. If you have already done so, then your browser might be statically linked to an older version of OpenSSL and should be updated as well.

Using the web API directly:

If you would like to use the web api directly to check if your server or other machine is vulnerable, You can run one of the following scripts which should give you one of the results above. If nothing is returned it is because your app doesn’t support TLS. If the script runs for a long time with no results or times out, try again later because the server load is probably too high.

  • curl https://allenwebb.tamu.edu
  • printf "\n" | openssl s_client -quiet -connect allenwebb.tamu.edu:443