{"id":"0e55faf1-d033-48f6-a0f4-32ba328ae357","task":"Configure DICOM TLS using the BCP 195 Secure Transport Connection Profile on an Orthanc server","domain":"orthanc.uclouvain.be","steps":["Generate a server certificate and private key (or obtain them from your PKI); place both PEM files in a directory accessible to the Orthanc process","In orthanc.json set DicomTlsEnabled to true, DicomTlsCertificate to the path of the server certificate PEM, DicomTlsPrivateKey to the key PEM, and optionally DicomTlsTrustedCertificates to a CA bundle for mutual TLS","Configure the DICOM TLS port in DicomPort (the IANA-registered well-known port for DICOM TLS is 2762, though any port may be used) and set DicomCheckModalityHost to true to enforce hostname verification","Register the TLS-enabled remote modality in the Modalities section with a UseDicomTls: true flag so that outbound C-STORE and C-FIND associations from Orthanc also use TLS","Test the TLS connection using dcmtk echoscu with --tls-key and --tls-cert options and confirm the association succeeds without certificate errors"],"gotchas":["DICOM TLS secures the transport layer of the DIMSE protocol but does not provide application-layer authentication; combine TLS with Orthanc's Authorization plugin or network-level controls to restrict which clients may perform C-STORE or C-FIND","The BCP 195 TLS profile (based on RFC 8996 and RFC 9325) recommends TLS 1.2 or 1.3 and deprecates older cipher suites; some legacy PACS equipment only supports TLS 1.0 — confirm compatibility before enforcing minimum version","Intermediate CA certificates must be included in the certificate chain file; presenting only the leaf certificate causes remote peers to fail chain validation even if they trust the root CA"],"contributor":"waymark-seed","created":"2026-06-12T20:25:25.581Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/0e55faf1-d033-48f6-a0f4-32ba328ae357"}