Per-connector TLS · no plugins
Add SSL/TLS to a Mirth connector
Wrap any Mirth Connect connector that can't do TLS natively — MLLP, TCP, or HTTP listeners — in encryption, without a channel plugin and without restarting Mirth. Claridex manages a stunnel sidecar so the secure endpoint sits in front of your existing connector.
TLS in front of Mirth, not inside it
Many Mirth interfaces still run MLLP or TCP in plaintext because the connector can't terminate TLS and rebuilding the channel is risky. Claridex adds a managed stunnel proxy per connector:
- Inbound listener— the proxy accepts TLS on a listen port and forwards plaintext to Mirth's own listener on loopback. Point external senders at the new TLS port; Mirth is untouched.
- Outbound sender — the proxy takes plaintext locally and sends TLS to the peer, and can re-point the Mirth connector for you through the admin API.
- Mutual TLS — supply the peer CA to verify client certificates; generate a self-signed proxy cert or import your own.
- Test before you commit— a real handshake against the target reports the negotiated protocol, cipher, and the far end's certificate, so a misconfigured binding never looks “secured” while messages go nowhere.
- Any port, firewall handled — Claridex opens exactly the listen port in the Windows firewall for the life of the binding and closes it on disable.
Enabling, renewing, or replacing a certificate reloads the proxy with no Mirth restart, and a live status column shows whether the encrypted wire and the downstream are actually up.
Frequently asked questions
- How do I add TLS to a Mirth MLLP listener?
- Claridex runs a managed stunnel proxy in front of the connector: it accepts TLS on a listen port and forwards plaintext to Mirth's existing MLLP listener over loopback. External senders point at the new TLS port — Mirth itself is unchanged.
- Does adding TLS require a Mirth channel plugin?
- No. The stunnel sidecar sits in front of the connector, so it works on any Mirth Connect or OIE version with no plugin and no channel changes.
- Does it support mutual TLS (client certificates)?
- Yes. Provide the peer CA and the proxy verifies client certificates. You can generate a self-signed proxy certificate, or import your own certificate and key.
- Do I have to restart Mirth to enable or renew TLS?
- No. Enabling, renewing, or replacing a proxy certificate reloads the proxy in place — no Mirth restart. For an outbound connector, Claridex can re-point Mirth at the proxy for you through the admin API.
- What happens if the far end goes down?
- The proxy continuously checks each binding's downstream and, after several consecutive failures, stops listening so senders get an immediate connection-refused instead of a silently-dropped message — and Mirth applies its own queue/retry. The port returns automatically when the downstream recovers.
Related: Mirth Connect certificate management · Mirth keystore & truststore management · Pricing