Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are optimizing our QOS router settings and it was decided that we should give priority to our PKI infrastructure. As far as I'm aware, there is network traffic when certificates are verified and when they are checked against the certificate revocation list (CRL). There may be some other reasons for network activity that I am not aware of.

What ports are associated with certificate-related network activity? Thanks.

share|improve this question
up vote 2 down vote accepted

That depends on what the revocation data on the certificate is configured for. It can change. Some use HTTP/HTTPS (TCP/80 and 443), others can use LDAP (TCP/389 and TCP/636 for secure) for that. Still others can use file paths, of all things, which can require SMB connectivity or other methods.

In other words, it uses basic network protocols and to my knowledge doesn't use special ports for that. As I said, the CRL locations are encoded on the certificates themselves and can be pretty much anything.

share|improve this answer

TechNet lists the ports required for Active Directory Certificate Services as:

  1. From CA Web Services to Domain Controllers on 464 for Kerberos
  2. From CA Web Services to Domain Controllers on 389 and 636 for LDAP
  3. From all XP clients to Certificate Authority on random above 1023 for DCOM/RPC
  4. From all clients to Certificate Authority on 443 for HTTPS
share|improve this answer

On-the-fly certificate revocation uses Online Certificate Status Protocol.

The port for this protocol isn't standardised, though - it's specified in the OCSP URL in the CA cert.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.