Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are optimizing our QOS router settings and it was decided that we should give priority to our PKI infrastructure. As far as I'm aware, there is network traffic when certificates are verified and when they are checked against the certificate revocation list (CRL). There may be some other reasons for network activity that I am not aware of.

What ports are associated with certificate-related network activity? Thanks.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

That depends on what the revocation data on the certificate is configured for. It can change. Some use HTTP/HTTPS (TCP/80 and 443), others can use LDAP (TCP/389 and TCP/636 for secure) for that. Still others can use file paths, of all things, which can require SMB connectivity or other methods.

In other words, it uses basic network protocols and to my knowledge doesn't use special ports for that. As I said, the CRL locations are encoded on the certificates themselves and can be pretty much anything.

share|improve this answer

On-the-fly certificate revocation uses Online Certificate Status Protocol.

The port for this protocol isn't standardised, though - it's specified in the OCSP URL in the CA cert.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.