Mirth Connect® & OIE
Mirth Connect certificate management
Issue, import, renew, and inspect the SSL/TLS certificates in your Mirth Connect and Open Integration Engine keystores — from a browser, with a timestamped backup before every change. No keytool command line, no guesswork about which flag renews what.
The whole certificate lifecycle, without the CLI
Managing certificates in Mirth by hand means long keytool commands against JCEKS keystores, mismatched keys, and expirations that surprise you at 2 a.m. Claridex covers each task explicitly:
- Self-signed certificate — a quick identity for internal or test use, generated in place (RSA-2048/3072/4096 or EC).
- Request from a CA — generate a CSR and private key to send to your certificate authority.
- Generate a CSR from an existing key — re-sign the same private key (for a partner that has pinned it), then install the reply onto that entry.
- Install CA reply — install a signed certificate onto the key that made the request; the private key stays put.
- Import key + cert — install a certificate together with its private key; Claridex checks they match first.
- Renew & Replace— update an expiring server certificate, or swap a trading partner's trusted certificate, from the row that's expiring.
- Expiry monitoring — email, Slack, or webhook alerts before a certificate lapses.
Every change writes a timestamped .bak next to the keystore first, and an integrity guard refuses any write that would drop an existing entry.
Frequently asked questions
- How do I renew an expiring certificate in Mirth Connect?
- It depends on where the private key lives. For a self-signed entry, Claridex re-issues it in place. For a CA-signed entry, generate a CSR from that existing key, have your CA sign it, then install the reply onto the same entry — Claridex does all of this in the app, so the private key never changes.
- How do I import a CA-signed certificate into Mirth's keystore?
- If you have the certificate and its matching private key, use Import key + cert. If the request was generated from the key already in the keystore, use Install CA reply and paste only the signed certificate (plus any intermediates). Claridex verifies the key and certificate match before writing.
- Does Claridex work with JCEKS and PKCS12 (.pfx) keystores?
- Yes. It reads and writes JKS, PKCS12 (.pfx / .p12) and JCEKS keystores using a bundled Java runtime, so it handles Mirth's default JCEKS store and custom PKCS12 stores alike.
- Do I need the keytool command line?
- No. Claridex runs keytool and OpenSSL for you behind a browser UI, and takes a timestamped backup of the keystore before every change.
- Will changing a certificate interrupt Mirth?
- Editing the keystore is separate from Mirth loading it. After you change the server's own certificate, point the connector at that entry and restart Mirth so it picks it up. To add TLS without touching Mirth's keystore or restarting, use per-connector TLS instead.
Related: Add SSL/TLS to a Mirth connector · Mirth keystore & truststore management · Pricing