9. Network Requirements¶

This page lists the network connections TrustView uses, so you can set up firewall rules for them. If your network is closed off, you only need to open the connections listed here. Start with the minimum, then add only the rows for the features you use.

TrustView initiates almost all of its own connections, so most of the access is outbound. The few inbound connections are listed under Inbound to TrustView.

9.1. Minimum (outbound from TrustView)¶

These are needed for TrustView to work.

Destination	Port	Used for
`api.trustskills.com`	TCP 443	The TrustView backend: license, version check and updates, SMS notifications, Certificate Transparency monitoring, domain scanning (including whois lookups), and ordering and validating certificates from DigiCert, Certum and other CAs. TrustView places these orders through the backend, not directly with the CA.
Your DNS servers	UDP and TCP 53	Name lookups for the endpoints and domains TrustView works with.
The SSL endpoints you monitor	The port of each endpoint, usually 443	Fetching and checking the certificate on each endpoint. This only applies to endpoints scanned by the `Local` scan agent - endpoints handled by another scan agent are reached from that agent’s network instead.
Your SMTP server	The port you have configured, usually TCP 25, 587 or 465	Sending notification e-mails, see SMTP gateway.

9.2. Recommended: revocation checks¶

When the details of a certificate are shown, in TrustView or through the API, TrustView checks whether the certificate has been revoked. It asks the OCSP responder named in the certificate, and if that fails, it downloads the CRL from the certificate’s CRL distribution points.

Destination	Port	Used for
The OCSP and CRL addresses in your certificates	Usually TCP 80 (plain HTTP)	Checking whether a certificate has been revoked.

Without this access, everything else in TrustView still works, but it can’t tell you whether a certificate has been revoked. The addresses depend on which CAs issued your certificates, so you can either allow outbound HTTP on port 80 in general, or open only the addresses of the CAs you use.

9.3. Per feature (outbound from TrustView, only if used)¶

Feature	Destination	Port and notes
Let’s Encrypt as certificate issuer	`acme-v02.api.letsencrypt.org` (Production) or `acme-staging-v02.api.letsencrypt.org` (Staging)	TCP 443
Cloudflare Origin CA as certificate issuer	`api.cloudflare.com`	TCP 443
DNS validation (DNS-01)	Your DNS provider’s API - see DNS provider hosts below - and the authoritative name servers of your domains	TCP 443 to the provider. UDP and TCP 53 to the name servers, where TrustView checks that the TXT record is in place before the CA validates it.
Cloud-based scanner	`view.trustskills.com`	TCP 443. Only if the cloud-based scanner is enabled under `Settings` `Scanning agents`. TrustView sends the scan tasks there, and also uses it to check whether a domain can be reached from the internet.
Azure Key Vault	`management.azure.com`, your Key Vault’s `<name>.vault.azure.net`, `login.microsoftonline.com` and `graph.microsoft.com`	TCP 443
Azure SSO and the Azure sync client	`login.microsoftonline.com` and `graph.microsoft.com`	TCP 443
Office 365 SMTP with OAuth2	`login.microsoftonline.com`, in addition to the SMTP server	TCP 443
Citrix NetScaler	The NetScaler’s management address	TCP 443 for the NITRO API, and TCP 22 for SSH/SFTP certificate upload
ServiceNow	Your ServiceNow instance, for example `<instance>.service-now.com`	TCP 443
MitID Erhverv	`services.nemlog-in.dk` (Production) or `services.devtest4-nemlog-in.dk` (Test)	TCP 443
ADFS services	The ADFS service’s URL, and `login.microsoftonline.com` when ADFS services are discovered while scanning a domain	TCP 443
Active Directory login and AD SSL endpoint discovery	Your domain controllers	TCP 389 (LDAP) or TCP 636 (LDAPS)
Network scan	The IP ranges you configure	The ports you configure
DNS zone transfers	Your DNS server	TCP 53
Subdomain lookup	`www.googleapis.com`	TCP 443
Revocation lists	The CRL addresses you add	Usually TCP 80
ACME challenge checking (off by default)	The domain being validated	TCP 80 for HTTP-01, and DNS for DNS-01

9.3.1. DNS provider hosts¶

All on TCP 443:

DNS provider	Destination
Cloudflare	`api.cloudflare.com`
DNSimple	`api.dnsimple.com`
EuroDNS	`rest-api.eurodns.com`
UltraDNS	`api.ultradns.com`
CSC	`apis.cscglobal.com`
ScanNet	`api.scannet.dk`
team.blue	`apiauth.dk.team.blue`
Dandomain	`api.dandomain.dk`
Curanet	`api.curanet.dk`
AWS Route 53	`route53.amazonaws.com`
Google Cloud DNS	`dns.googleapis.com` and `oauth2.googleapis.com`
Azure DNS	`management.azure.com` and `login.microsoftonline.com`
Infoblox and Akamai	The API host you configure
File system	None from TrustView. If the path is a network share, the file server on TCP 445 (SMB), see the BIND example.

9.4. Inbound to TrustView¶

Source	Port	Used for
Your users’ browsers, and API clients such as Zabbix	The HTTPS port TrustView runs on, usually TCP 443	The web interface and the API.
The servers running your ACME or SCEP clients	TCP 443	The Automation module, if licensed. TrustView acts as the ACME/SCEP server, so the clients start the connection.
Your scan agents	TrustView’s HTTPS port	Agents connect to TrustView to fetch scan tasks and return results. TrustView never connects to an agent, so the agent only needs outbound access to TrustView and to the endpoints it scans.
The ADCS module service, if installed on another server than TrustView	TrustView’s HTTPS port	Sending issued and imported certificates to TrustView. The service is usually installed on the TrustView server itself, and then no rule is needed. If it’s installed closer to the CA instead, open this connection from that server.