Mutual TLS for Jira Cards – Miro Help Center

Available on: Enterprise Plan

Available for: Jira on-premise (Server / Data Center)

Mutual Transport Layer Security allows establishing an even more secure connection between your Jira instance and Miro. The functionality is automatically supported on all Enterprise plans and does not require any configuration on the Miro end.

⚠️ Note that this article does not present detailed instructions but simply provides a sample configuration and our certificate (at the end of the article). Please consult with your IT team and your system administrators, because depending on your network infrastructure the configuration steps may differ.

Ways to configure

There are two options to choose from when it comes to how the validation will be checked:

Via the certificate
Via the certificate's fingerprint

Choose the method you prefer and adjust the NGINX configuration that you have using one of the following snippets. Be sure to replace 127.0.0.1 with your Jira instance IP or web address and enter our certificate values instead of ENTER_MIRO_CERTIFICATE_HERE.

Validating via the certificate

Find the sample for the NGINX configuration below:

ssl_verify_client optional;
ssl_verify_depth 3;
set $cert_old "ENTER_OLD_MIRO_CERTIFICATE_HERE";
set $cert_new "ENTER_NEW_MIRO_CERTIFICATE_HERE";
set $valid_cert_flag 0;

location /jira/plugins/servlet/oauth/authorize {
       proxy_pass http://127.0.0.1/jira/plugins/servlet/oauth/authorize;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Server $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      client_max_body_size 10M;
      proxy_redirect off;
}

location /jira/login.jsp {
        proxy_pass http://127.0.0.1/jira/login.jsp;
       proxy_set_header X-Forwarded-Host $host;
       proxy_set_header X-Forwarded-Server $host;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       client_max_body_size 10M;
       proxy_redirect off;
}

location /jira {
     if ($ssl_client_raw_cert ~ $cert_old) { set $valid_cert_flag 1; }
if ($ssl_client_raw_cert ~ $cert_new) { set $valid_cert_flag 1; }
if ($valid_cert_flag != 1) { return 403 "Invalid certificate\n"; }
       proxy_pass http://127.0.0.1/jira;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Server $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      client_max_body_size 10M;
      proxy_redirect off;
   }

Validating via the certificate's fingerprint

Find the sample for the NGINX configuration below:

ssl_verify_client optional;
       ssl_verify_depth 3;
set $fingerprint_old "ENTER_OLD_FINGERPRINT_OF_MIRO_CERTIFICATE_HERE";
set $fingerprint_new "ENTER_NEW_FINGERPRINT_OF_MIRO_CERTIFICATE_HERE";
set $valid_fingerprint_flag 0;

location /jira/plugins/servlet/oauth/authorize {
       proxy_pass http://127.0.0.1/jira/plugins/servlet/oauth/authorize;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Server $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      client_max_body_size 10M;
      proxy_redirect off;
}

location /jira/login.jsp {
        proxy_pass http://127.0.0.1/jira/login.jsp;
       proxy_set_header X-Forwarded-Host $host;
       proxy_set_header X-Forwarded-Server $host;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       client_max_body_size 10M;
       proxy_redirect off;
}

location /jira {
if ($ssl_client_fingerprint = $fingerprint_old) { set $valid_fingerprint_flag 1; }
if ($ssl_client_raw_cert = $fingerprint_new) { set $valid_fingerprint_flag 1; }
if ($valid_fingerprint_flag != 1) { return 403; }
       proxy_pass http://127.0.0.1/jira;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Server $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      client_max_body_size 10M;
      proxy_redirect off;
  }

Miro certificates

The old certificate is valid until April 4, 2024.

The new certificate is valid until April 6, 2025.

Articles in this section

Ways to configure

Validating via the certificate

Validating via the certificate's fingerprint

Miro certificates

Related articles