Example 1

Candidate Certificate Subject DN	Passes?	Reason
CN=My Server, OU=NHIN, C=US		Missing O=HHS-ONC
CN=My Server, OU=NHIN, OU=My Org Unit, O=HHS-ONC, C=US, ST=California		Has all required components, even if an extra OU is present
C=US, O=HHS-ONC, OU=NHIN		Has all required components, order doesn't matter

SSL Manager User Guide

Example 2

Distinguished Name: CN=My Server 1 CN=My Server 2,OU=R&D Full Match: Yes Set Trusted Certificate Subject DNs window displaying Distinguished Name and Full Match values Candidate Certificate Subject DN Passes? Reason CN=My Server, O=NextGen, OU=R&D Check mark icon Exact match OU=R&D, O=NextGen, CN=My Server Check mark icon Exact match, order doesn't matter CN=My Server, O=NextGen X icon Missing OU=R&D CN=My Server, O=NextGen, OU=R&D, C=US X icon Has extra untrusted component Parent topic: Subject DN Validation

SSL Manager User Guide

Example 3

Distinguished Names: CN=My Server 1 CN=My Server 2,OU=R&D Full Match: No Set Trusted Certificate Subject DNs window with Distinguished Name and Full Match values Candidate Certificate Subject DN Passes? Reason CN=My Server, O=NextGen, OU=R&D X icon Doesn't match any entry CN=My Server 1, O=NextGen Check mark icon Matches the first entry CN=My Server 2, O=NextGen X icon Doesn't match any entry CN=My Server 2, O=NextGen, OU=R&D Check mark icon Matches the second entry Parent topic: Subject DN Validation

SSL Manager User Guide

Subject DN Validation

If enabled, only client certificates with subject distinguished names (DNs) matching the given list will be allowed. If a client certificate not matching any of the trusted DNs is presented, the SSL connection / handshake will fail. Subject DN Validation option on the SSL Settings window Select the wrench icon to open the Trusted Subject DNs window: Set Trusted Certificate Subject DNs window Select the New / Delete buttons to add or remove entries. For each Trusted Subject DN entry, configure the following: Distinguished Name: The full or partial distinguished name (DN) to trust. This will be matched against the Subject DN of the remote certificate. Full Match: If enabled, all components (RDNs) configured here must match the ones in the certificate, and the subject DN cannot have any additional components. If disabled, the components configured here will only be considered a required subset, and the subject DN may have additional components. Example 1 Example 2 Example 3 Parent topic:

SSL Manager User Guide

Apply Destination Connector SSL Settings

On the Channels page, double-click a channel in the Channel list. Select the Destinations tab. In the Connector Type field, select the connector type that supports the SSL Manager (HTTP Sender, Web Service Sender, File Writer in FTP mode). In the SSL Settings section, the SSL Manager is inactive. If you populate the URL field in the HTTP Sender Settings section, the field turns yellow with a Lock icon next to the URL. If you move the pointer over the Lock icon, a tool tip appears that explains the reason for the situation. (Selecting the Lock icon opens a window with the same content as the tool tip.) Adding a URL while the Manager is Inactive In the SSL Settings section - Use SSL Manager field, select Yes to nullify the locked condition and enable all security options and two-way authentication. (The URL field turns green to reflect the change.) Enabling SSL Manager Select the wrench icon to open the SSL Settings window: Items on the SSL Settings Window Item Name Default Value Descrip

Mirth® Appliance by NextGen Healthcare Deployment Guide, 4.1

External LDAP Authentication

You can use external LDAP server credentials to log on to the Control Panel. Select System > Users > External LDAP Authentication to define these settings. Note: The local admin user can always log on with their regular credentials even if the external LDAP server is inaccessible. External LDAP Authentication window The following table displays example values for inputs on the External LDAP Authentication window, but you can consult your local network administrator for the appropriate values for your environment. The Group Search Base and Membership Search Filter inputs are optional; these inputs can be used to restrict which user accounts are able to log on to the Control Panel. Table 1. Example Values for Integrating with Active Directory Field Example Value Note LDAP URL ldap://w.x.y.z Replace w.x.y.z with the IP or host name of your Active Directory server. Admin User DN CN=Administrator, CN=Users, DC=example, DC=local Provide a valid DN. Admin Password password Provide a valid pas

Mirth® Connect by NextGen Healthcare User Guide

SSL Manager Extension

This section only applies if you have the SSL Manager extension installed. This guide will summarize the available settings, but there is a separate user guide specifically written for the SSL Manager that goes into depth about all the available features. Contact our help desk to obtain a copy of the SSL Manager guide. Source Connector Settings Client Authentication: Client authentication (sometimes called mutual or bi-lateral authentication) can provide additional security as both the client and server must present certificates that the other can choose to trust or not. The Trusted Client Certificatessection determines which client certs (or intermediate/root certs) to trust. Present Issuer DNs: This is only applicable when Client Authentication is used. If enabled, during the SSL handshake the server will respond with a list of accepted client issuer distinguished names (DNs). Disabling this can provide extra security as potential attackers are given less information about the correc

Example 1

Recommendations

Example 2

Example 3

Subject DN Validation

Apply Destination Connector SSL Settings

External LDAP Authentication

SSL Manager Extension

Example 2

Example 3

Subject DN Validation

Apply Destination Connector SSL Settings

External LDAP Authentication

SSL Manager Extension