Innovar Healthcare Plugins | Downloads & Guides

Advanced Access Control Plugin

Manage secure, role-based permissions

View Guide Download

Channel History Plugin

Audit and view historical channel activity

Built-in 26.3

🎉

Now included with BL 26.3.0! Automatically bundled with BridgeLink 26.3.0. No plugin install needed.

View Guide Download

Cognito Plugin

Enable AWS Cognito single sign-on

View Guide Download

OIDC Plugin

OpenID Connect integration for secure authentication

View Guide Download

OpenAI Plugin

Integrate AI-assisted workflows

View Guide Download

SSL Plugin

Configure SSL settings and certificates

View Guide Release Notes Download

🔒

SSL Plugin

v3.1

New Features

Validation Mode Selector - Choose PKIX Chain, Pinned Leaf, or Trust All per connector
Certificate Revocation Checking - OCSP, CRL, or OCSP with CRL fallback (opt-in)
Expiration Notifications - Daily background check, 30-day advance warning (configurable)
Subject/SAN Policy Filter - Regex rules to restrict inbound client certs on listeners

Security Updates

Password required on export - Private keys now require keystore password before exporting
Lockout protection - 3 failed attempts triggers a 60-second lockout
Audit logging - All certificate export attempts are written to the audit log

Improvements

TLS 1.1 disabled by default - New channels default to TLS 1.2 & 1.3; legacy still available with warning
Expanded key formats - Auto-detects PKCS#8, PKCS#12 (.p12/.pfx), and DER on import
JKS export - Java KeyStore format now surfaced in the Export Format dropdown

🚀 New Features

Certificate Chain Validation Modes

A formal Validation Mode selector gives you explicit control over how inbound certificates are evaluated. Three modes are available:

PKIX Chain Validation (default)

Standard X.509 chain validation. The full certificate chain is verified against your configured truststores. This remains the default for all existing and new connectors.

Pinned Leaf Certificate

For zero-trust and high-security environments. Select one or more specific leaf certificates - only those exact certificates are trusted at runtime, regardless of what the chain says.

Trust All

Disables all certificate validation. Intended for development and testing only. Not recommended for production use.

⚠️ Existing connectors are unaffected - they continue using PKIX Chain Validation. Validation Mode is opt-in for any new configuration.

Certificate Revocation Checking

Connectors can now optionally check whether a certificate has been revoked before accepting it. Four modes:

Disabled (default) - No revocation checking. Existing connectors are unaffected.
OCSP Only - Checks the OCSP responder specified in the certificate.
CRL Only - Downloads and checks the Certificate Revocation List.
OCSP with CRL Fallback - Attempts OCSP first; falls back to CRL if unavailable.

⚠️ Entirely opt-in - will not affect any existing connector configurations.

Certificate Expiration Notifications

A new background service runs daily and alerts you when certificates are approaching expiration - 30 days in advance by default. The advance warning window is configurable. All server, client, and truststore certificates are checked automatically.

Subject/SAN Policy Filter (Listeners only)

An opt-in security layer for SSL Listener connectors. Define regex rules evaluated against the connecting client's Subject DN and SANs. Connections from non-matching certificates are rejected, adding an enforcement point beyond chain trust.

🛡️ Security Updates

Certificate Export Now Requires Password Authentication

The Certificate Manager now requires you to enter the keystore password before exporting any certificate that contains a private key. Previously, private keys could be exported without any authentication.

Password dialog on export: A prompt appears when you click Export on any certificate entry.
Lockout protection: 3 consecutive failed attempts triggers a 60-second lockout.
Audit logging: All export attempts - successful or failed - are written to the audit log.

⚠️ Existing automated scripts that export certificates will need to be updated to pass the keystore password parameter.

✨ Improvements

TLS 1.1 disabled by default: New channels default to TLS 1.2 and TLS 1.3 only. TLS 1.1 can still be manually enabled for legacy compatibility but is marked with a ⚠️ warning in the UI. Existing channels are unaffected.
Expanded private key format support: Auto-detects and imports PKCS#8, PKCS#12 (.p12, .pfx), and DER-encoded formats. Clearer error messages indicate which formats were attempted if auto-detection fails.
JKS export format: Certificate export to JKS (Java KeyStore) is now clearly surfaced in the Export Format dropdown.

⚙️ Configuration Notes

No changes to mirth.properties or other configuration files are required.

This is a non-breaking release. All existing channel configurations and SSL settings are fully preserved on upgrade. New features are strictly opt-in.