Upcoming changes to the TLS Ciphers supported by Atlassian Cloud products

As industry security standards such as TLS and its associated ciphers evolve, Atlassian will deprecate support for older, less secure protocols and ciphers as part of our quest to better secure Atlassian cloud products. 

On Feb 15, 2021, we will be dropping support for some legacy cryptographic ciphersuites that are used for encrypting data in-transit between our customers and our cloud products.

These changes will:

  • Drop support for ciphersuites utilizing the Cipher-Block-Chaining (CBC) mode of operation

  • Drop support for ciphersuites utilizing the SHA1 hash algorithm

  • Drop support for ciphersuites that do not provide perfect forward secrecy (PFS)

The updated TLS configuration is designed to ensure that data in-transit between customers and Atlassian’s cloud products continue to remain safe and secure well into the future while also maintaining compatibility with a broad range of clients.

The following table lists the ciphers that will be supported by Atlassian products after this change.

 

Cipher Suite & Protocol

atlassian.com, Atlassian Marketplace, Trello, Halp

Bitbucket Cloud, Confluence Cloud, Jira Cloud, Jira Service Desk

Statuspage

TLS_AES_128_GCM_SHA256

TLS 1.3

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

TLS_AES_256_GCM_SHA384

TLS 1.3

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

TLS_CHACHA20_POLY1305_SHA256

TLS 1.3

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-17 at 9.46.25 am.png

Screen Shot 2020-12-17 at 9.46.25 am.png

TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

TLS 1.2

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-17 at 9.46.25 am.png

Screen Shot 2020-12-17 at 9.46.25 am.png

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS 1.2

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS 1.2

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

TLS 1.2

Screen Shot 2020-12-17 at 9.46.25 am.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

TLS 1.2

Screen Shot 2020-12-17 at 9.46.25 am.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

TLS 1.2

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-17 at 9.46.25 am.png

Screen Shot 2020-12-17 at 9.46.25 am.png

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

TLS 1.2

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-17 at 9.46.25 am.png

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

TLS 1.2

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

Screen Shot 2020-12-17 at 9.46.25 am.png

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS 1.2

Screen Shot 2020-12-17 at 9.46.25 am.png

Screen Shot 2020-12-17 at 9.46.25 am.png

Screen Shot 2020-12-16 at 2.50.23 pm.png

8 comments

Comment

Log in or Sign up to comment
Soumyadeep Mandal
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
December 19, 2020

Hi @Corey Johnston ,

Thanks for sharing the information & updates!

Like Corey Johnston likes this
Gonchik Tsymzhitov
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
January 9, 2021

@Corey Johnston  Thank you for that info. 

I have curious question about the background of the splits into those 3 groups.

To me externally it works with a few layers: revers proxy which do SSL termination, and traffic after works without ciphering traffic.

In your arch language it's Atlassian edge, https://confluence.atlassian.com/cloud/atlassian-cloud-architecture-973494795.html 

I will be happy to read more info about architecture of Atlassian cloud. Because to me still unclear SSL termination how does it works, how do you do a load balancing etc. 

Corey Johnston
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
January 12, 2021

@Gonchik Tsymzhitov Yes, that cloud architecture diagram is a high level "birds eye view". Under the hood, our Edge consists of a number of different technologies to terminate public traffic for our Cloud products. This is part of the reason behind the three groupings you mentioned. 

Alex van Vucht (GLiNTECH)
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
April 28, 2021

Can you please advise what cipher suites are supported by the Apache HttpClient used by the Application Links feature in Atlassian Cloud products? They do not appear to align with the list here.

Corey Johnston
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
April 29, 2021

@Alex van Vucht (GLiNTECH) , good question. Its best to open a case with our support team so they can look into that with our Atlassian Cloud product teams. https://support.atlassian.com/contact/

espen_willumsen February 15, 2023

@Corey Johnston There are demands connected to Public/Government Service Management BIDS in Norway, where TLS 1.3 is mandatory by 01.01.24.

Does Atlassian have any plans connected to Cipher Suite & Protocol still using TLS 1.2?

Corey Johnston
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
February 15, 2023

Hi Espen, 

Atlassian has supported TLS 1.3 for a number of years now, see the following advisory for details: https://support.atlassian.com/security-and-access-policies/docs/supported-security-protocols-for-atlassian-cloud-products/

We currently have no plans to deprecate TLS 1.2.

espen_willumsen February 16, 2023

Thanks for the feedback @Corey Johnston . Several public/government organizations in Norway are now demanding TLS 1.3 only on service management platforms, from 01.01.24

This means that Atlassian partners will be encountering problems with delivering JSM on public BIDS.

We just have to see then how we can handle this.

TAGS
AUG Leaders

Atlassian Community Events