title: How can I ensure that Ruby uses an OpenSSL not vulnerable to Heartbleed?
body: <p>Following the Heartbleed bug, <a href="https://www.ruby-lang.org/en/news/2014/04/10/severe-openssl-vulnerability/" rel="noreferrer">this post on ruby-lang.org</a> describes how to check vulnerability and upgrade.</p>
  
  <p>It includes this advice:</p>
  
  <hr>
  
  <p>To verify which version of the OpenSSL library you link to Ruby, use the following:</p>
  
  <pre><code>ruby -v -ropenssl -rfiddle -e 'puts Fiddle::Function.new(Fiddle.dlopen(nil)["SSLeay_version"], [Fiddle::TYPE_INT], Fiddle::TYPE_VOIDP).call(0)'
  </code></pre>
  
  <p>To verify the version of OpenSSL currently installed with Ruby, use the following:</p>
  
  <pre><code>ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
  </code></pre>
  
  <hr>
  
  <p>What is the difference between these two checks, and what action is recommended if a bad version is returned from either command?</p>