Example 3

Candidate Certificate Subject DN	Passes?	Reason
CN=My Server, O=NextGen, OU=R&D		Doesn't match any entry
CN=My Server 1, O=NextGen		Matches the first entry
CN=My Server 2, O=NextGen		Doesn't match any entry
CN=My Server 2, O=NextGen, OU=R&D		Matches the second entry

SSL Manager User Guide

Example 2

Distinguished Name: CN=My Server 1 CN=My Server 2,OU=R&D Full Match: Yes Set Trusted Certificate Subject DNs window displaying Distinguished Name and Full Match values Candidate Certificate Subject DN Passes? Reason CN=My Server, O=NextGen, OU=R&D Check mark icon Exact match OU=R&D, O=NextGen, CN=My Server Check mark icon Exact match, order doesn't matter CN=My Server, O=NextGen X icon Missing OU=R&D CN=My Server, O=NextGen, OU=R&D, C=US X icon Has extra untrusted component Parent topic: Subject DN Validation

SSL Manager User Guide

Example 1

Distinguished Name: OU=NHIN,O=HHS-ONC,C=US Full Match: No Set Trusted Certification Subject DNs window displaying the Distinguished Name and Full Match values Candidate Certificate Subject DN Passes? Reason CN=My Server, OU=NHIN, C=US X icon Missing O=HHS-ONC CN=My Server, OU=NHIN, OU=My Org Unit, O=HHS-ONC, C=US, ST=California Check mark icon Has all required components, even if an extra OU is present C=US, O=HHS-ONC, OU=NHIN Check mark icon Has all required components, order doesn't matter Parent topic: Subject DN Validation

SSL Manager User Guide

Subject DN Validation

If enabled, only client certificates with subject distinguished names (DNs) matching the given list will be allowed. If a client certificate not matching any of the trusted DNs is presented, the SSL connection / handshake will fail. Subject DN Validation option on the SSL Settings window Select the wrench icon to open the Trusted Subject DNs window: Set Trusted Certificate Subject DNs window Select the New / Delete buttons to add or remove entries. For each Trusted Subject DN entry, configure the following: Distinguished Name: The full or partial distinguished name (DN) to trust. This will be matched against the Subject DN of the remote certificate. Full Match: If enabled, all components (RDNs) configured here must match the ones in the certificate, and the subject DN cannot have any additional components. If disabled, the components configured here will only be considered a required subset, and the subject DN may have additional components. Example 1 Example 2 Example 3 Parent topic:

Mirth® Appliance by NextGen Healthcare Deployment Guide, 4.1

External LDAP Authentication

You can use external LDAP server credentials to log on to the Control Panel. Select System > Users > External LDAP Authentication to define these settings. Note: The local admin user can always log on with their regular credentials even if the external LDAP server is inaccessible. External LDAP Authentication window The following table displays example values for inputs on the External LDAP Authentication window, but you can consult your local network administrator for the appropriate values for your environment. The Group Search Base and Membership Search Filter inputs are optional; these inputs can be used to restrict which user accounts are able to log on to the Control Panel. Table 1. Example Values for Integrating with Active Directory Field Example Value Note LDAP URL ldap://w.x.y.z Replace w.x.y.z with the IP or host name of your Active Directory server. Admin User DN CN=Administrator, CN=Users, DC=example, DC=local Provide a valid DN. Admin Password password Provide a valid pas

Advanced Alerting User Guide

SSL Certificate Validation

The SSL Certificate Validation trigger type listens for error events thrown by the SSL Manager extension whenever SSL certificates get validated by a channel. This type is only available when the SSL Manager is also installed. Option Description Validation Errors Select all of the error types you want the alert to trigger on. Expired: The alert triggers when a certificate you have currently imported has expired or is close to expiring. The Cert Expiration Settings (Time Until Expiration and Re-trigger Interval) provides additional conditions to this when Expired is selected. Revoked by CRL: The alert triggers when a certificate has been revoked in a Certificate Revocation List. This indicates the certificate is no longer valid and should be replaced. Revoked by OCSP: The alert triggers when a certificate has been revoked in a response from an OCSP (Online Certificate Server Protocol) server. This indicates the certificate is no longer valid and should be replaced. DN Rejected: The aler

SSL Manager User Guide

Apply Destination Connector SSL Settings

On the Channels page, double-click a channel in the Channel list. Select the Destinations tab. In the Connector Type field, select the connector type that supports the SSL Manager (HTTP Sender, Web Service Sender, File Writer in FTP mode). In the SSL Settings section, the SSL Manager is inactive. If you populate the URL field in the HTTP Sender Settings section, the field turns yellow with a Lock icon next to the URL. If you move the pointer over the Lock icon, a tool tip appears that explains the reason for the situation. (Selecting the Lock icon opens a window with the same content as the tool tip.) Adding a URL while the Manager is Inactive In the SSL Settings section - Use SSL Manager field, select Yes to nullify the locked condition and enable all security options and two-way authentication. (The URL field turns green to reflect the change.) Enabling SSL Manager Select the wrench icon to open the SSL Settings window: Items on the SSL Settings Window Item Name Default Value Descrip

Example 3

Recommendations

Example 2

Example 1

Subject DN Validation

External LDAP Authentication

SSL Certificate Validation

Apply Destination Connector SSL Settings

Example 2

Example 1

Subject DN Validation

External LDAP Authentication

SSL Certificate Validation

Apply Destination Connector SSL Settings