If you're terminating SSL on your Jira server, something administrators miss quite often is setting the ciphers to secure and disabling protocols such as TLSv.1.0 and 1.1.
How to check your settings?
First, go to SSLLabs and drop in your Jira url. Give it a test. You'll get a cool looking report card on how you're doing and what you need to do to fix things.
Second, review your server.xml file. On your Jira application server, this is typically located under the Jira_Home directory in the conf folder. Scroll down that file and check your connector settings, you'll see something like:
if you don't see a line that says "ciphers=".....", you may have a problem.
How to fix it?
So you got a B on your SSLLabs score, and your connector settings in your server.xml look kind of lame. Lets fix it.
Open back up your server.xml file and lets force sslprotocol to TLS1.2 and lets setup some secure cipher usage. The final product should look something like:
SSLEnabled="true" acceptCount="100" clientAuth="false"
connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false"
keyAlias="AwesomeKey" keystoreFile="keystore" keystorePass="rockingpassword" keystoreType="JKS"
maxHttpHeaderSize="8192" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" port="443"
scheme="https" secure="true" sslProtocol="TLSv1.2" sslEnabledProtocols="TLSv1.2" useBodyEncodingForURI="true"
Obviously, use your own keystore folder and keystore password.
Next, run the SSLLabs test again:
You've done it!
Congratulations, you're now one bit more secure.
Now a few notes of caution. Always test this sort of change on your staging environment first, and I've done this on Jira 7.4+.
Can I use this configuration on Confluence?
Yes, absolutely.... go for it... but do it in your staging server.xml first, please :)
I use Bitbucket, what's its TLSv1.2 Setting?
BitBucket uses a slightly different configuration. Look in the bitbucket.properties file found in Bitbucket\shared\ folder. The configuration lines you need will look like:
Last, last note... remember any time you change these config files, you need to restart your instance. So, service stop/start/restart or restart your application server.
Gregory Van Den HamCommunity Champion
Badges are a great way to show off community activity, whether you’re a newbie or a Champion.Learn more
@Rachel Wright (Jira Genie), @Billy Poggi (AUG NOVA, DC), and @Dana Jansen (Confluence Queen) are just some of the folks that lead one of the world's most active Atlassian User Group (AUG)....
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs