Network Endpoints and Allow-listing
This page lists the network flows the customer must allow. All connections from the customer network to EC are outbound; no inbound connection into the customer network is required.
Required network flows
| Source | Destination | Port / protocol | Purpose |
|---|---|---|---|
| All relying parties (clients, servers, devices) | CDP and AIA host name, e.g. pki.example.com (CNAME to Azure Blob) | TCP 80 / HTTP | Download CRLs and CA certificates for chain building and revocation checks |
| Administrators and portal users | Self-Service Portal: FQDN agreed during design | TCP 443 / HTTPS | Portal access |
| Enrollment Gateway | EC Issuing CA / CLM endpoint: FQDN(s) and IP addresses agreed during design | TCP 443 / HTTPS (outbound) | Forward Windows auto-enrollment requests |
| Domain-joined clients | CEP server and Enrollment Gateway (customer network) | TCP 443 / HTTPS | Enrollment policy and enrollment requests (Kerberos) |
| NDES server | EC Issuing CA endpoint: FQDN(s) agreed during design | TCP 443 / HTTPS (outbound) | Forward SCEP requests |
| ACME clients | ACME directory: FQDN agreed during design | TCP 443 / HTTPS | Automated issuance and renewal |
| Applications and scripts | Portal REST API: FQDN agreed during design | TCP 443 / HTTPS | Automated certificate operations |
EC IP addresses
Where the firewall or proxy filters by IP address rather than host name, allow the EC addresses below. The exact host names and IP addresses are agreed during design, follow the approved architecture, and are recorded in the Client Intake Form. Any later change follows the agreed change process.
Proxies and TLS inspection
- Allow the EC host names in the outbound proxy for the Enrollment Gateway, NDES and API clients.
- If TLS inspection is in use, exclude the Enrollment Gateway and NDES traffic to EC from inspection, or confirm with EC that inspection is supported, because inspection replaces the server certificate the gateway validates.
- CDP and AIA URLs use plain HTTP by design. Do not redirect them to HTTPS; see the FAQ.
Test connectivity
# From the Enrollment Gateway or NDES server
Test-NetConnection <ec-endpoint-fqdn> -Port 443
# From any client: CRL and AIA reachability
Invoke-WebRequest http://pki.example.com/pki/<Issuing CA name>.crl -UseBasicParsing