This article is designed to explain some of the specifics around SSL and TLS within the Jira Align infrastructure and product.
The Jira Align infrastructure includes multiple service tiers. The Jira Align Web Application deals with inbound traffic only while the Jira Align Connectors are outbound traffic only.
For outbound requests, Jira Align only supports TLS 1.2 as the secure standard.
More specifically, these are the TLS 1.2 ciphers that Jira Align supports:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
Figure 1.1: Example of Jira Align to Jira/Proxy with Mutual TLS
Mutual TLS goes hand-in-hand with Outbound Requests as the client certificate is enabled by default.
The server that is hosting Jira or the Proxy in front of Jira is responsible for enforcing Mutual TLS. The enforcer of Mutual TLS will request Jira Align to provide the Client Certificate. Jira Align will then use the client certificate as part of the process and the private key for the signature as part of the CertificateVerify message.
Jira Align requires a Trusted 3rd Party Certificate (ex: DigiCert, Sectigo, GoDaddy, etc.) to be used with Mutual TLS.
There are 3 certificate types that can be used:
Wildcard Jira Align Certificate, owned by Atlassian (*.jiraalign.com)
Non-Wildcard Jira Align Certificate, owned by Atlassian (Ex: customer.jiraalign.com )
Custom Certificate, owned by Customer (Ex: jiraalign.customer.com )
NOTE: Regarding Custom SSL Certificates that are owned by the Customer: The Customer is responsible for renewing this certificate before the expiration date, notifying us via a Jira Align Support ticket, and working with Jira Align Support to coordinate the certificate swap.
NOTE2: When generating a Customer-owned Custom certificate, please check with your Network Security Team to ensure that you are following your organization's policies and procedures.
For inbound requests, Jira Align only supports TLS 1.2 as the secure standard.
More specifically, these are the TLS 1.2 ciphers that Jira Align supports:
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
As part of certificate validation, Jira Align will validate:
The certificate has not expired
The issuer of the server/client certificate is signed from a valid trusted 3rd party CA
Issuer’s digital signature contained in server certificate is valid
The domain name on the certificate matches the domain of the server
Certificate is not revoked
James McCulley
Network & Security Solutions Architect
Atlassian
0 comments