Skip to content
LambogeniusDocs

HL7 MLLP Connector for Azure Logic Apps

TLS (MLLPS)

MLLP over TLS 1.2 or 1.3, certificates, mutual TLS, pinning, and requiring TLS everywhere.

Service provider/serviceProviders/lamboHl7MllpLicensed together with the HL7 v2 Codec. One token covers both.

Settings

Set useTls on the connection. The same settings serve both directions:

SettingReceive trigger (server)Send message (client)
TLS version (tlsVersion)Version to accept: 1.2 (default) or 1.3Version to connect with: 1.2 (default) or 1.3
TLS certificate (+ password)Server certificate, requiredOptional client certificate (mutual TLS)
TLS trusted thumbprintsClient certificates allowed (when required)Server certificates to trust even if self-signed or named differently, in addition to normally valid ones
TLS trust only these thumbprints—Accept only the listed thumbprints (certificate pinning)
TLS require client certificateRequire mutual TLS—
TLS server name—Name expected in the server certificate (default: host)
TLS allow untrusted certificatesAccept any client certificate (testing only)Accept any server certificate (testing only)

Example: a pinned connection with a client certificate

"mllpEmrTls": {
  "displayName": "MLLP over TLS (EMR, pinned)",
  "serviceProvider": { "id": "/serviceProviders/lamboHl7Mllp" },
  "parameterValues": {
    "host": "@appsetting('MLLP_EMR_HOST')",
    "port": "@appsetting('MLLP_EMR_TLS_PORT')",
    "useTls": "true",
    "tlsVersion": "1.2",
    "tlsServerName": "emr.hospital.internal",
    "tlsTrustedThumbprints": "@appsetting('MLLP_EMR_THUMBPRINT')",
    "tlsTrustedThumbprintsOnly": "true",
    "tlsCertificate": "@appsetting('MLLP_CLIENT_CERTIFICATE')"
  }
}
  • Certificates can be a thumbprint (certificate store), a .pfx/.pem path, or Base64 PFX content, which is how a Key Vault certificate reference arrives in an app setting.
  • Pinning: trusted thumbprints alone add trust. Also turn on “trust only these thumbprints” to accept only the listed certificates, for example to pin a partner's CA-issued certificate.
  • Require TLS everywhere: the app setting LamboHl7Mllp__Security__RequireTls = true stops plain-MLLP triggers from starting and makes plain sends fail with 403. The gateway's equivalent is Gateway:RequireTls.
  • Versions: both sides must use the same one. TLS 1.3 needs Windows Server 2022 / Windows 11 or later, or Linux with OpenSSL 1.1.1+. TLS 1.1 and older aren't supported.
  • Run outputs include tlsProtocol and, with mutual TLS, the client certificate's subject and thumbprint.