Upcoming changes to the TLS Ciphers supported by Atlassian Cloud products

[#1]

As industry security standards such as TLS and its associated ciphers evolve, Atlassian will deprecate support for older, less secure protocols and ciphers as part of our quest to better secure Atlassian cloud products. 

On Feb 15, 2021, we will be dropping support for some legacy cryptographic ciphersuites that are used for encrypting data in-transit between our customers and our cloud products.

These changes will:

• Drop support for ciphersuites utilizing the Cipher-Block-Chaining (CBC) mode of operation

• Drop support for ciphersuites utilizing the SHA1 hash algorithm

• Drop support for ciphersuites that do not provide perfect forward secrecy (PFS)

The updated TLS configuration is designed to ensure that data in-transit between customers and Atlassian’s cloud products continue to remain safe and secure well into the future while also maintaining compatibility with a broad range of clients.

The following table lists the ciphers that will be supported by Atlassian products after this change.

Cipher Suite & Protocol	atlassian.com, Atlassian Marketplace, Trello, Halp	Bitbucket Cloud, Confluence Cloud, Jira Cloud, Jira Service Desk	Statuspage
TLS_AES_128_GCM_SHA256 TLS 1.3
TLS_AES_256_GCM_SHA384 TLS 1.3
TLS_CHACHA20_POLY1305_SHA256 TLS 1.3
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS 1.2
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS 1.2
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS 1.2
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS 1.2
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS 1.2
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS 1.2
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS 1.2

[Soumyadeep Mandal]

Hi @Corey Johnston ,

Thanks for sharing the information & updates!

[Gonchik Tsymzhitov]

@Corey Johnston  Thank you for that info. 

I have curious question about the background of the splits into those 3 groups.

To me externally it works with a few layers: revers proxy which do SSL termination, and traffic after works without ciphering traffic.

In your arch language it's Atlassian edge, https://confluence.atlassian.com/cloud/atlassian-cloud-architecture-973494795.html 

I will be happy to read more info about architecture of Atlassian cloud. Because to me still unclear SSL termination how does it works, how do you do a load balancing etc. 

[Corey Johnston]

@Gonchik Tsymzhitov Yes, that cloud architecture diagram is a high level "birds eye view". Under the hood, our Edge consists of a number of different technologies to terminate public traffic for our Cloud products. This is part of the reason behind the three groupings you mentioned.