GE TLS (Authenticated)

Use this workflow when your GE system is configured for anonymous TLS client behavior.

Applies to

• Users with Integrations: DICOM permission (typically Administrators)
• Site staff with GE system admin access

Before you begin

1. Navigate to Settings > Integrations > DICOM.

2. Click View DICOM Endpoints and note the following under 'DICOM via TLS':

• Server AE title.
• Server IP address.
• TLS port (typically 11112).

3. Download Server CA Certificate in PEM Format.
4. Click Create DICOM Identity.
5. Enter a name, and device AE title. Note: GE machines often have default AE titles found in Config > Connectivity > TCPIP.
6. Click Save.
7. Click on the newly created DICOM Identity.

IMAGE PLACEHOLDER

8. Toggle 'DICOM TLS' off.
9. Download TLS certificate in PEM Format.

The server AE title, server IP address, server CA certificate, and TLS certificate will be used in a later step.

Importing Certificates

1. On GE, navigate to Utilities > Configuration > Admin > LDAP > Certificates.

2. From the dialog, click Personal > Certificates.

3. From the toolbars, select Action > Tools > Import.
4. From the Import Wizard, find and import the TLS certificate (the name of the certificate will be that of the machine you are setting up)
5. If prompt for a password, enter "pulse".
6. Check 'Mark this key as exportable…' and 'Include all exported properties'.
7. Click Finish
8. Repeat the above process but for Server CA certificate.

Installing Certificates

1. On GE, navigate to Utilities > Config > Connectivity > TCP/IP > Client Certificates > My

2. Select the imported certificate and click Ok.

Configure GE dataflow

1. On GE, navigate to Utilities > Config > Connectivity > Dataflow.

2. Create a new data flow or edit an existing dataflow.
3. Add 'LocalArchiveService' to both Input and Output.
4. Add 'DicomStorage' to Output.
5. Select 'DicomStorage' and click Configure, and configure the following:
   • IP address: HeartLab server IP
   • AE title: HeartLab server AE title
   • Port: 11112
   • Enable Transport Layer Security, Verify Server Certificate, Provide Client Certificate, SR, SR Private Data and Multiframe

• Click Ok to finish set up.

Verify

1. Run connectivity check from the GE dataflow target.
2. Send a test study and confirm it appears in HeartLab.

Notes

• If check fails on newer software versions, disable ICMP echo dependency in advanced DICOM settings.
• Use the authenticated TLS guide if your site requires client certificates.