Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenEMR is Accepting Donations on OpenCollective

openemr.blog

Post reply on HN
Print view View original

41–45 of 45 posts

Re: OpenEMR is Accepting Donations on OpenCollective

#41

Post by toomuchtodo »

jesdynf wrote: post #38
toomuchtodo wrote: post #35

Earlier quoted context omitted.

I just spoke with someone today who argued that HIPAA requires TLS termination on an instance, not the ELB. Can’t confirm or deny, as I’m in financial services, thought I’d mention it for those under such compliance/regulations.

Yeah, you won't believe the work I had to put in over it. As part of the stack creation process, I have to create a backend CA and hand certificates out to a bunch of services, and then make other services use 'em. Getting Elastic Beanstalk to use an arbitrary certificate for the backhaul is both possible and documented, but not as well I would've liked.

Let me know what would’ve made it easier on the AWS side and I’ll try to get it implemented with our TAM.

Re: OpenEMR is Accepting Donations on OpenCollective

#42

Post by [deleted] »

jesdynf wrote: post #38
toomuchtodo wrote: post #35

Earlier quoted context omitted.

I just spoke with someone today who argued that HIPAA requires TLS termination on an instance, not the ELB. Can’t confirm or deny, as I’m in financial services, thought I’d mention it for those under such compliance/regulations.

Yeah, you won't believe the work I had to put in over it. As part of the stack creation process, I have to create a backend CA and hand certificates out to a bunch of services, and then make other services use 'em. Getting Elastic Beanstalk to use an arbitrary certificate for the backhaul is both possible and documented, but not as well I would've liked.

[deleted]

Re: OpenEMR is Accepting Donations on OpenCollective

#43

Post by jesdynf »

toomuchtodo wrote: post #41
jesdynf wrote: post #38

Earlier quoted context omitted.

Yeah, you won't believe the work I had to put in over it. As part of the stack creation process, I have to create a backend CA and hand certificates out to a bunch of services, and then make other services use 'em. Getting Elastic Beanstalk to use an arbitrary certificate for the backhaul is both possible and documented, but not as well I would've liked.

Let me know what would’ve made it easier on the AWS side and I’ll try to get it implemented with our TAM.

It was CloudFormation that made it difficult -- I had to work out exactly how to get the certificate all the way down to the load balancer's configuration details, starting from CloudFormation's interface into provisioning Elastic Beanstalk.

However, the format ELB would accept a certificate in was really frustrating, too -- I ended up having to create a Lambda function that would load a certificate file from S3 and then parse it and then return the results as a resource CFN could later refer to. If I could've simply provided an S3 URI that the CA lived in, and had the ELB load it up during initial config, I could've used many fewer layers.

The CFN syntax for actually setting those critical ELB details was also unclear, too. It took some experimentation and off-Amazon examples before I finally understood how the rule groupings worked together.

If you're curious about what the final results were, the tail-end of https://github.com/openemr/openemr-devops/blob/master/packag.... covers a lot of that ground. Thanks!

Re: OpenEMR is Accepting Donations on OpenCollective

#44

Post by exception_e »

toomuchtodo wrote: post #40
exception_e wrote: post #37

Earlier quoted context omitted.

Great idea! I'm going to show this to a few of the folks on our non-profit board. From first glance, it looks like a great fit. Thanks, Matthew

Spectacular! Please let me know if I can be of any assistance. Not related to Watsi, but happy to do whatever legwork is required. Passionate about effective, efficient healthcare delivery.

Awesome! I have a million things on my plate with the project so if you want, you can reach out to me at matthewvita48 (at) gmail (dot) com so we can discuss what may interest you!

Re: OpenEMR is Accepting Donations on OpenCollective

#45

Post by toomuchtodo »

exception_e wrote: post #44
toomuchtodo wrote: post #40

Earlier quoted context omitted.

Spectacular! Please let me know if I can be of any assistance. Not related to Watsi, but happy to do whatever legwork is required. Passionate about effective, efficient healthcare delivery.

Awesome! I have a million things on my plate with the project so if you want, you can reach out to me at matthewvita48 (at) gmail (dot) com so we can discuss what may interest you!

I’ll be in touch shortly!
Post reply on HN