If you're terminating SSL on your Jira server, something administrators miss quite often is setting the ciphers to secure and disabling protocols such as TLSv.1.0 and 1.1.
How to check your settings?
First, go to SSLLabs and drop in your Jira url. Give it a test. You'll get a cool looking report card on how you're doing and what you need to do to fix things.
Second, review your server.xml file. On your Jira application server, this is typically located under the Jira_Home directory in the conf folder. Scroll down that file and check your connector settings, you'll see something like:
if you don't see a line that says "ciphers=".....", you may have a problem.
How to fix it?
So you got a B on your SSLLabs score, and your connector settings in your server.xml look kind of lame. Lets fix it.
Open back up your server.xml file and lets force sslprotocol to TLS1.2 and lets setup some secure cipher usage. The final product should look something like:
SSLEnabled="true" acceptCount="100" clientAuth="false"
connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false"
keyAlias="AwesomeKey" keystoreFile="keystore" keystorePass="rockingpassword" keystoreType="JKS"
maxHttpHeaderSize="8192" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" port="443"
scheme="https" secure="true" sslProtocol="TLSv1.2" sslEnabledProtocols="TLSv1.2" useBodyEncodingForURI="true"
Obviously, use your own keystore folder and keystore password.
Next, run the SSLLabs test again:
You've done it!
Congratulations, you're now one bit more secure.
Now a few notes of caution. Always test this sort of change on your staging environment first, and I've done this on Jira 7.4+.
Can I use this configuration on Confluence?
Yes, absolutely.... go for it... but do it in your staging server.xml first, please :)
I use Bitbucket, what's its TLSv1.2 Setting?
BitBucket uses a slightly different configuration. Look in the bitbucket.properties file found in Bitbucket\shared\ folder. The configuration lines you need will look like:
Last, last note... remember any time you change these config files, you need to restart your instance. So, service stop/start/restart or restart your application server.
Gregory Van Den Ham
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events