How do we update the TLS in Jira and does it support TLS 2.0?

[sanjay.rakh]

Jira instance 7.13 and the sslprotocol= TLS in server.xml file.

We are looking into the security of all our servers and applications and need to get everything up to TLS 2.0 if possible.

Does it possible to update the TLS to 2.0 and how?

Thanks

Sanjay Rakh

[Nic Brough -Adaptavist- · Accepted solution]

Depends on how you are running it and what version of Jira you have.

If you are running it behind a proxy where SSL is terminated, then Jira is irrelevant.  TLS is handled by the proxy and you just need to configure the proxy to reject the lower versions of TLS that you don't want to use (not strictly necessary, but it will block people using insecure methods from having any access)

If you're doing SSL in Tomcat (Jira doesn't do it itself, it runs on the application server Tomcat which is handling stuff like that), then see https://confluence.atlassian.com/jirakb/how-to-disable-sslv3-to-mitigate-against-poodle-exploit-for-jira-680395044.html

Bear in mind you'll need to be on a version of Jira that has a Tomcat that supports the methods you want to use