Default Supported Cipher Suites

Mirth® Connect by NextGen Healthcare User Guide

Default Supported Cipher Suites

The following cipher suites are supported by default for the overall server when using TLS / SSL / HTTPS: TLS_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_AES_256_GCM_SHA384 TLS_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 TLS_EMPTY_RENEGOTIATION_INFO_SCSV Depending on your Java installation and other factors (like having the JCE Unlimited Strength policy files installed), not all the cipher

Mirth® Connect by NextGen Healthcare User Guide

New Protocol/Cipher Suite Support in Java 11

Java 11 added support for TLS v1.3. This should be added to your supported protocols list in mirth.properties when you upgrade to version 3.7 or later. If you do not want to support TLS v1.3, you can remove that from the list. Java 11 also added support for new and more secure cipher suites. Upon upgrade to version 3.7 or later they should be automatically added. Check your mirth.properties file for these cipher suites: TLS_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_AES_256_GCM_SHA384 TLS_AES_128_GCM_SHA256 Parent topic: Secure Configuration

Mirth® Connect by NextGen Healthcare User Guide

Cipher Suites Removed From Earlier Versions

The following cipher suites were removed from mirth.properties starting in version 3.5 to address vulnerabilities like SWEET32. Upon upgrade the cipher suites should automatically be updated to remove any that use TripleDES. Check your mirth.properties file to make sure that they are not included: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA The following cipher suites were removed from mirth.properties starting in version 4.0. Check your mirth.properties file to make sure they are not included: TLS_RSA_WITH_AES_256_CBC_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

Mirth® Connect by NextGen Healthcare User Guide

4.0.0 Upgrade Notes

Database Reader XML Casing In 3.12.0 we updated Apache Commons DBUtils and made some associated changes in our code. As part of that change, the XML created by the Database Reader was using the same case that appeared in the actual SQL query, whereas before 3.12.0 everything was normalized to lowercase. In 4.0.0, we made some more updates in the Connect codebase to, again, normalize the casing to all lowercase. If you are upgrading to 4.0.0 from any version before 3.12.0 there is no change for you and database queries will use the casing they always have. If you are upgrading to 4.0.0 from 3.12.0 and had made changes adding AS clauses in your queries to work around the casing change in 3.12.0 there is no change for you. If you experienced database query errors after upgrading to 3.12.0 due to casing in the query statements, after upgrading to 4.0.0 you should no longer encounter those errors. TLS Protocols and Cipher Suites Default TLS protocols and cipher suites have been updated. Wea

Mirth® Connect by NextGen Healthcare User Guide

Secure Configuration

Encryption Settings Encrypt Database Password Plain HTTP Main Web Server Default TLS/SSL Settings Default Supported Cipher Suites Password Requirements SSL Manager Extension Encryption Settings Encrypt Database Password Plain HTTP Main Web Server Default TLS/SSL Settings Default Supported Cipher Suites Cipher Suites Removed From Earlier Versions New Protocol/Cipher Suite Support in Java 11 Password Requirements SSL Manager Extension Parent topic: Security Best Practices

Mirth® Connect by NextGen Healthcare User Guide

Default TLS/SSL Settings

The following properties can be set to modify the default TLS settings: Property Default Value Description https.client.protocols TLSv1.3,TLSv1.2 The protocols to support by default for all TLS/SSL/HTTPS client traffic. CAUTION: Changing this property could leave your server vulnerable to certain SSL-based attacks. Note: The SSL Manager enables you to adjust protocol settings on a per-connector basis, rather than having to change the value for the entire server. Note: TLSv1.3 is only available when running Mirth Connect on Java 11 or later. https.server.protocols TLSv1.3,TLSv1.2,SSLv2Hello The protocols to support by default for all TLS/SSL/HTTPS server traffic. CAUTION: Changing this property could leave your server vulnerable to certain SSL-based attacks. Note: The SSL Manager enables you to adjust protocol settings on a per-connector basis, rather than having to change the value for the entire server. Note: TLSv1.3 is only available when running Mirth Connect on Java 11 or later. ht

Default Supported Cipher Suites

Recommendations

Default Supported Cipher Suites

New Protocol/Cipher Suite Support in Java 11

Cipher Suites Removed From Earlier Versions

4.0.0 Upgrade Notes

Secure Configuration

Default TLS/SSL Settings

Default Supported Cipher Suites

New Protocol/Cipher Suite Support in Java 11

Cipher Suites Removed From Earlier Versions

4.0.0 Upgrade Notes

Secure Configuration

Default TLS/SSL Settings