CodeSign Secure Documentation
  • Overview
    • About CodeSign Secure
    • Getting Started
    • Documentation Guide
    • Portal Overview
    • Troubleshooting
      • FAQ
    • Glossary
  • Reference Guide
    • Header Bar
      • CodeSign Secure Documentation
      • Swagger API
      • Profile Section
    • Dashboard
      • Key Performance Indicators
      • Issued Certificates
      • Signatures Generated
      • HSM Health Check
    • Keys and Certificates
      • Key and Certificate Lifecycle
    • App Management
    • Signing Requests
      • Approval Workflows
    • Signing Tools
    • Reports
      • Signing Request Report
      • Audit Trail
      • Certificate Report
      • Client Report
    • Logs
    • System Setup
      • Identity Store
      • Backup
      • User
      • Roles and Permissions
      • Email
      • Signing Projects
      • SSL/TLS Management
      • Environment
      • Plugins
  • Setup & Architecture
    • Identity and Access Control
    • Architecture and Concepts
    • Installation
      • Windows
        • Installing the Server
        • Ports and Protocols
        • High Availability and Backup
        • Upgrades and Compatibility
    • Security
      • Security Hardening Checklist
      • Client Authentication
      • Designing Signing Policies
  • Release Notes
    • Releases for 2026
      • v3.2.1
    • Releases for 2025
      • v3.2.0
    • Releases for 2024
      • v3.1.0
  • API Reference
    • Getting Started
    • Authorizing Requests
    • Securing API Access
    • Request and Response Conventions
    • Endpoint Reference
      • Signing
      • Signing Requests
      • Certificates
      • Applications and Environments
      • User Management
      • Permissions
      • Email
      • System Setup
      • Reports
      • Dashboard
      • License
  • Integration Guides
    • Signing Capabilities
      • Supported Formats and Platforms
      • Timestamping
      • Windows Signing - SignTool
        • Signing
        • Macro Signing
      • Apple Signing
      • AppX & MSIX Signing
      • Visual Studio ClickOnce
      • Jar Signing
      • Sign HLK/HCK using CodeSign Secure
      • NuGet Signing
      • Mage Signing
      • Sign OVA/OVF using Encryption Consulting’s Utility Tool
      • Utility Tool for code signing
      • Container Signing
      • PKCS11 Wrapper
        • APK Signing
        • OpenSSL Signing
        • XML Signing
        • JSign Tool Signing
        • Jarsigner Signing
        • GPG2, Debian & RPM Signing
      • Reproducible Build
        • Automated Hash Validation
        • Reproducible Build Process Flow
        • Pipeline Script Components
        • Hash Validation
    • CI/CD Integration
      • GitHub Actions
      • Jenkins
      • GitLab
      • Azure DevOps
      • TeamCity
      • Bamboo
      • Securing CI/CD Credentials

Ports and Protocols

Every network connection CodeSign Secure uses, so you can configure firewalls and proxies before you deploy.

Summary

CodeSign Secure needs one inbound port: HTTPS on TCP 443, by default, which serves both the portal and the REST API at https://<your domain>/api/. Apart from the HTTPS port, the server only needs the connections your HSM requires. Everything else in the table below is an outbound connection that you enable only for the features you use. You can configure CodeSign Secure to use another HTTPS port, such as 8443. If you do, open that port instead and include it in URLs, for example https://<your domain>:8443/api/.

Connections
SourceDestinationPort and protocolPurposeRequired
Browsers (administrators, approvers, auditors)CodeSign Secure server or load balancerTCP 443 by default (configurable, for example 8443), HTTPSPortalYes
Build machines and CI agents (KSP, EC KSP for Mac, PKCS#11 Wrapper, Utility Tool, ec-signer)CodeSign Secure server or load balancerTCP 443 by default (configurable, for example 8443), HTTPS with client certificateREST API under /api/Yes
Scripts and integrationsCodeSign Secure server or load balancerTCP 443 by default (configurable, for example 8443), HTTPSREST APIOptional
CodeSign Secure serverHSMAs required by your HSM. Vendor defaults: Entrust nShield Connect TCP 9004; Thales Luna Network HSM (NTLS) TCP 1792; Securosys Primus TCP 2300; Utimaco SecurityServer TCP 288.Key generation and signingYes
CodeSign Secure serverSMTP serverThe port set in Email > Config, for example TCP 587Notifications and approval MFA codesYes, if you use approvals, MFA or email alerts
CodeSign Secure serverlogin.microsoftonline.com, graph.microsoft.comTCP 443, HTTPSAzure AD sign-in and user and group lookupsYes
CodeSign Secure serverSharePoint through Microsoft Graph (graph.microsoft.com)TCP 443, HTTPSCloud backupsIf the backup location is Cloud
CodeSign Secure serverGrafana LokiProtocol and port set in the plugin, for example HTTP 3100Log export through OpenTelemetryOptional
CodeSign Secure serverSplunkProtocol and port set in the pluginLog export through OpenTelemetryOptional

Note: HSM ports are vendor defaults. Confirm the port and connection direction against your own HSM configuration.

Ports that must stay closed

On a single server, MongoDB and the internal ports used between Apache, the backend, and the frontend are local to the machine. Don’t expose them on the network. Only the configured TCP port for the portal should be reachable from other hosts.

Proxies

If build machines reach the server or the timestamp authority through a proxy, allow HTTPS to the CodeSign Secure domain without TLS inspection. Clients authenticate with a client certificate, and TLS inspection breaks mutual TLS. Timestamp requests are separate connections to the TSA; see Timestamping.

On this Page:
Support Privacy Policy Terms of Service

Copyright Encryption Consulting LLC. All rights reserved.