Skip to content

SSL

The SSL fieldset configures TLS for the connection. It is available for the REST, SOAP, IHE, Google Cloud Healthcare, and Open AI types. It is not available for the deprecated QIE Web Service type.

TLS Version

Selects the TLS protocol version used for outbound calls. The default Allow All Supported Versions lets QIE and the endpoint negotiate the highest version both support. Pinning a specific version (TLSv1.2, TLSv1.3, etc.) is useful when an endpoint advertises support for a version it cannot actually negotiate, or when an organization policy mandates a specific minimum.

Trust Policy

Controls which server certificates QIE accepts during the TLS handshake.

  • Use JVM Keystore/Truststore: accept any certificate trusted by the underlying Java runtime's truststore. Suitable for endpoints signed by a public certificate authority. When this option is selected, Allow concurrent calls to this web service is disabled.
  • Trust All Certificates: accept any certificate, including self-signed and expired. Useful for development and testing; not recommended for production.
  • Trust Selected Certificates: accept only the certificates explicitly listed in the grid that appears below the drop-down. Select certificates that have been imported on the Certificate Management page.

Client Auth

Configures client-authenticated (mutual) TLS. Available only when Trust Policy is Trust All Certificates or Trust Selected Certificates.

  • None: QIE does not present a client certificate.
  • Enable (but not required): QIE presents a client certificate if the server requests one, and continues the handshake even if the server does not request one.
  • Required: QIE completes the handshake only if the server requests a client certificate. Use this for endpoints that mandate mTLS.

When Client Auth is anything other than None, the Client Cert drop-down appears for selecting which key/certificate to present.

Client Cert

Selects the private key and certificate QIE presents to the server during the TLS handshake. The drop-down lists the keys configured on the Certificate Management page. The vendor only needs your public certificate. Never send your private key.

Override cipher suites for this connection

When checked, the Cipher Suites text box appears for entering a comma-separated list of cipher suite names. QIE then restricts the TLS handshake to those suites. When unchecked, the JVM's default suites for the negotiated TLS version are used.

Cipher Suites

A comma-separated list of cipher suite names (for example, TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256). Only used when Override cipher suites for this connection is checked. Leave blank to fall back to the JVM defaults.

TLS Certificates

When the endpoint uses HTTPS, QIE is the client in the TLS connection. For endpoints signed by a public certificate authority (most commercial APIs) no extra configuration is needed. QIE already trusts the common CAs. For self-signed endpoints or endpoints signed by a private/internal CA, import the endpoint's public certificate on the Certificate Management page so QIE trusts it.

If the endpoint requires client-authenticated (mutual) TLS, generate a private key in QIE, generate a CSR, get it signed (or self-sign), and configure the connection to present that certificate during the handshake. The vendor only needs your public certificate. Never send your private key.

See Certificate Management for how to generate, import, and export keys and certificates.