TLS

TLS on both sides

On a source, tls turns an MLLP listener into MLLPS, or an HTTP endpoint into HTTPS (TLS 1.2 or 1.3). Add client_ca to require callers to present a certificate signed by that CA. On a destination, tls controls the client side of MLLPS and HTTPS: the operating system's certificate store is trusted by default, and you can add a private CA or present a client certificate.

[[route]]
name = "lab-oru"
mode = "store_and_forward"

[route.source]
type = "mllp"
listen = "0.0.0.0:7890"
# MLLPS: MLLP over TLS 1.2/1.3. With client_ca, senders must present a certificate.
tls = { cert = "certs/gateway.pem", key = "certs/gateway.key", client_ca = "certs/meditech-ca.pem" }

[route.destination]
type = "http"
url = "https://somewhere.com/lab/oru"
# Trust a private CA, or present a client certificate (mutual TLS).
tls = { ca = "certs/lab-ca.pem", system_roots = true, client_cert = "certs/client.pem", client_key = "certs/client.key" }

Every PEM can come from an environment variable instead of a file:

# PEM text, or base64 of it, from an environment variable (Key Vault, Secrets Manager…).
# One combined PEM (chain + key) can serve as both cert and key.
tls = { cert_env = "MLLPS_PEM", key_env = "MLLPS_PEM", client_ca_env = "MEDITECH_CA_PEM" }

The admin console can be served over HTTPS too: [admin] tls = { cert = "…", key = "…" }.

To test an MLLPS route: hl7-edge-gateway send --to gw.example.org:7890 --tls --ca ca.pem samples/oru-r01.hl7.