Upcoming changes to the TLS Ciphers supported by Atlassian Cloud products

[#1]

As industry security standards such as TLS and its associated ciphers evolve, Atlassian will deprecate support for older, less secure protocols and ciphers as part of our quest to better secure Atlassian cloud products. 

On Feb 15, 2021, we will be dropping support for some legacy cryptographic ciphersuites that are used for encrypting data in-transit between our customers and our cloud products.

These changes will:

• Drop support for ciphersuites utilizing the Cipher-Block-Chaining (CBC) mode of operation

• Drop support for ciphersuites utilizing the SHA1 hash algorithm

• Drop support for ciphersuites that do not provide perfect forward secrecy (PFS)

The updated TLS configuration is designed to ensure that data in-transit between customers and Atlassian’s cloud products continue to remain safe and secure well into the future while also maintaining compatibility with a broad range of clients.

The following table lists the ciphers that will be supported by Atlassian products after this change.

Cipher Suite & Protocol	atlassian.com, Atlassian Marketplace, Trello, Halp	Bitbucket Cloud, Confluence Cloud, Jira Cloud, Jira Service Desk	Statuspage
TLS_AES_128_GCM_SHA256 TLS 1.3
TLS_AES_256_GCM_SHA384 TLS 1.3
TLS_CHACHA20_POLY1305_SHA256 TLS 1.3
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS 1.2
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS 1.2
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS 1.2
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS 1.2
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS 1.2
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS 1.2
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS 1.2

[Soumyadeep Mandal]

Hi @Corey Johnston ,

Thanks for sharing the information & updates!

[Gonchik Tsymzhitov]

@Corey Johnston  Thank you for that info. 

I have curious question about the background of the splits into those 3 groups.

To me externally it works with a few layers: revers proxy which do SSL termination, and traffic after works without ciphering traffic.

In your arch language it's Atlassian edge, https://confluence.atlassian.com/cloud/atlassian-cloud-architecture-973494795.html 

I will be happy to read more info about architecture of Atlassian cloud. Because to me still unclear SSL termination how does it works, how do you do a load balancing etc. 

[Corey Johnston]

@Gonchik Tsymzhitov Yes, that cloud architecture diagram is a high level "birds eye view". Under the hood, our Edge consists of a number of different technologies to terminate public traffic for our Cloud products. This is part of the reason behind the three groupings you mentioned. 

[Alex van Vucht (GLiNTECH)]

Can you please advise what cipher suites are supported by the Apache HttpClient used by the Application Links feature in Atlassian Cloud products? They do not appear to align with the list here.

[Corey Johnston]

@Alex van Vucht (GLiNTECH) , good question. Its best to open a case with our support team so they can look into that with our Atlassian Cloud product teams. https://support.atlassian.com/contact/

[espen.willumsen]

@Corey Johnston There are demands connected to Public/Government Service Management BIDS in Norway, where TLS 1.3 is mandatory by 01.01.24.

Does Atlassian have any plans connected to Cipher Suite & Protocol still using TLS 1.2?

[Corey Johnston]

Hi Espen, 

Atlassian has supported TLS 1.3 for a number of years now, see the following advisory for details: https://support.atlassian.com/security-and-access-policies/docs/supported-security-protocols-for-atlassian-cloud-products/

We currently have no plans to deprecate TLS 1.2.

[espen.willumsen]

Thanks for the feedback @Corey Johnston . Several public/government organizations in Norway are now demanding TLS 1.3 only on service management platforms, from 01.01.24

This means that Atlassian partners will be encountering problems with delivering JSM on public BIDS.

We just have to see then how we can handle this.