Keystores & truststores
Mirth Connect keystore & truststore management
Point Claridex at your Mirth install and it reads mirth.properties to find the keystore, its format, and its password — then shows every certificate entry and lets you manage them safely. JKS, PKCS12 (.pfx), and JCEKS are all first-class.
From mirth.properties to a readable list of certificates
Mirth keeps its certificates in a Java keystore whose path and password live in conf/mirth.properties. Finding it, opening it with the right store type, and listing what's inside usually means keytool. Claridex does it for you:
- Discovery — give it the Mirth folder (or
mirth.propertiesdirectly) and it resolveskeystore.path, the store type, andkeystore.storepass, reading them server-side so secrets stay on the host. - Every format — JKS, PKCS12 (
.pfx/.p12), and JCEKS, via a bundled JRE. If the password inmirth.propertiescan't open the store, you can supply the correct one and re-check. - Clear entry view — subject, issuer, expiry, and key type for each entry, with the soonest-expiring surfaced first.
- Trust a partner— import a trading partner's or a CA's certificate into the keystore or a separate truststore.
- Safe by default — a timestamped backup before every change and an integrity guard that never drops an existing entry.
Frequently asked questions
- Where is the Mirth Connect keystore, and what is its password?
- Mirth records the keystore path and its store password in conf/mirth.properties (keystore.path and keystore.storepass). Claridex reads those server-side to locate and open the store, so passwords never travel through the browser. If the file's password is stale or blank, you can supply the correct one in the app and re-check.
- Does Claridex support a PKCS12 (.pfx) keystore?
- Yes. It reads and writes JKS, PKCS12 (.pfx / .p12), and JCEKS using a bundled Java runtime. Mirth's default is JCEKS; a custom .pfx works the same way as long as its store password is correct.
- What is the difference between the keystore and the truststore?
- The keystore holds the server's own certificates and private keys — the identities it presents. The truststore holds certificates the server trusts, such as a trading partner's or a CA's. Many Mirth installs keep everything in one keystore and have no separate truststore, which is fine.
- How do I trust a partner's certificate in Mirth?
- Use Trust a certificate and paste their certificate (no private key needed). If your Mirth has a separate truststore, it has its own import for the same purpose.
- Is it safe to edit the keystore directly?
- Claridex takes a timestamped backup next to the keystore before every change and runs an integrity check that refuses any write which would drop an existing entry, so a bad edit can't silently lose keys.
Related: Mirth Connect certificate management · Add SSL/TLS to a Mirth connector · Pricing