Plain HTTP Main Web Server

Mirth® Connect by NextGen Healthcare User Guide

Default TLS/SSL Settings

The following properties can be set to modify the default TLS settings: Property Default Value Description https.client.protocols TLSv1.3,TLSv1.2 The protocols to support by default for all TLS/SSL/HTTPS client traffic. CAUTION: Changing this property could leave your server vulnerable to certain SSL-based attacks. Note: The SSL Manager enables you to adjust protocol settings on a per-connector basis, rather than having to change the value for the entire server. Note: TLSv1.3 is only available when running Mirth Connect on Java 11 or later. https.server.protocols TLSv1.3,TLSv1.2,SSLv2Hello The protocols to support by default for all TLS/SSL/HTTPS server traffic. CAUTION: Changing this property could leave your server vulnerable to certain SSL-based attacks. Note: The SSL Manager enables you to adjust protocol settings on a per-connector basis, rather than having to change the value for the entire server. Note: TLSv1.3 is only available when running Mirth Connect on Java 11 or later. ht

Mirth® Connect by NextGen Healthcare User Guide

Networking

By it is very nature, Mirth® Connect is an application that typically has a lot of inbound and outbound connections. It is up to you (or your IT staff) to decide how lenient or strict you want your firewall to be. Typically all inbound access is denied by default, and specific IP/port rules are added for specific channels. Outbound connectivity is less of a concern, and typically all outbound connections are allowed. Image of the network topography By default, Mirth® Connect listens on two ports: 8080 and 8443. These ports are used by the web server that serves up the main launch page, as well as API access (which the Administrator GUI and CLI use). The specific ports used can be configured in mirth.properties: http.port https.port You can disable plain HTTP altogether by simply commenting out the "http.port" entry. This ensures that only secure HTTP (HTTPS) is used for all main web server traffic. Parent topic: Secure Installation and Deployment

Mirth® Connect by NextGen Healthcare User Guide

Secure Configuration

Encryption Settings Encrypt Database Password Plain HTTP Main Web Server Default TLS/SSL Settings Default Supported Cipher Suites Password Requirements SSL Manager Extension Encryption Settings Encrypt Database Password Plain HTTP Main Web Server Default TLS/SSL Settings Default Supported Cipher Suites Cipher Suites Removed From Earlier Versions New Protocol/Cipher Suite Support in Java 11 Password Requirements SSL Manager Extension Parent topic: Security Best Practices

SSL Manager User Guide

Enabled TLS/SSL Protocols

The protocol is the version of the TLS/SSL standard that is used by both the client and server. By default, only the most secure protocols are enabled, but if you are communicating with a legacy server that only supports an older, weaker protocol, you can configure your connector to use it without affecting any other connectors or channels. Enabled Protocols option on SSL Settings window Select the wrench icon to open the Set Protocols window: Set Protocols window The server defaults refers to the protocols configured for the overall Mirth® Connect by NextGen Healthcare server, in mirth.properties. If your connector is a listener (for example, HTTP Listener), then the defaults will extend from the server protocols ("https.server.protocols"). Otherwise they will extend from the client protocols ("https.client.protocols"). You can find more information in the mirth.properties section of the Mirth Connect User Guide, accessible through the NextGen Knowledge Center. To override the server

Mirth® Connect by NextGen Healthcare User Guide

Web Server Certificate

The certificate used for the main web server is stored in the keystore.jks file. If not present, Mirth® Connect will automatically create a new certificate upon startup. Since this auto-generated certificate is self-signed, you will see security warnings in your browser if you navigate to the HTTPS landing page. You can replace this auto-generated certificate with your own company cert. This could still be self-signed or signed by an internal service if API/HTTPS access will only occur on your private company network. If you expose the API/HTTPS traffic over a publicly accessible DNS, you should replace this certificate with one that is signed by a CA (certificate authority). For instructions on how to replace the web server certificate, look here: Application Data Directory Parent topic: Secure Installation and Deployment

Mirth® Connect by NextGen Healthcare User Guide

mirth.properties File

This is the main configuration file that tells Mirth® Connect where to store application data, what web server ports to listen on, and which database to connect to. You can also set other security and encryption options. The following properties are supported: Property Default Value Description Directories dir.appdata appdata The location of the Application Data Directory. dir.tempdata ${dir.appdata}/temp The location of the temporary files directory, by default set inside of the Application Data Directory. Ports http.port 8080 The HTTP port to make the web server available from. This is used to access the launch page and download signed client resources from. If this property is omitted or commented out, the web server only starts up on the HTTPS port. https.port 8443 The HTTPS port to make the web server available from. This is used to access the secure opening of a page, web dashboard, and all REST API traffic (which includes the Administrator and CLI) . Password Requirements passwo

Plain HTTP Main Web Server

Recommendations

Default TLS/SSL Settings

Networking

Secure Configuration

Enabled TLS/SSL Protocols

Web Server Certificate

mirth.properties File

Plain HTTP Main Web Server

Default TLS/SSL Settings

Networking

Secure Configuration

Enabled TLS/SSL Protocols

Web Server Certificate

mirth.properties File