A Java Servlet I maintain uses SSL encryption. I THINK it uses JSSE SSL by Oracle and after the HeartBleed Bug announcement I don't want to be using OpenSSL. Can someone tell me how I can be sure this is the case please?
So far I have found nothing on Google.
This isn't so much about the openssl command (which might not be on your path anyway) than about the OpenSSL library.
If you're using Tomcat, you would be relying on the OpenSSL library if you've set up the APR connector. Otherwise, you'll be using the JSSE (unless you've providing your own SSLImplementation classes, which is very unlikely).