Outbound network access
The hosts and ports CertAutoPilot reaches from your network. Use this page to scope egress firewall rules. Only the services you actually configure need to be reachable — there is no mandatory always-on egress, so open each group as you turn its feature on.
On use — only required when you enable that feature or configure that provider. Customer-defined — host is whatever you point it at; listed here so the category isn't forgotten.
License activation
On use — only when you activate a license in online mode. A Free instance (no license key) and an offline (signed-file) license make no call to this host; the product runs fully without it.
| Service | Host | Port |
|---|---|---|
| License API (online activation + periodic re-check) | license-api.cloudnativeworks.com | 443 / HTTPS |
Public certificate authorities
Open only the CAs you plan to issue from.
| Service | Host | Port |
|---|---|---|
| Let's Encrypt (production) | acme-v02.api.letsencrypt.org | 443 / HTTPS |
| Let's Encrypt (staging) | acme-staging-v02.api.letsencrypt.org | 443 / HTTPS |
| Google Trust Services (production) | dv.acme-v02.api.pki.goog | 443 / HTTPS |
| Google Trust Services (staging) | dv.acme-v02.test-api.pki.goog | 443 / HTTPS |
| Sectigo | acme.sectigo.com | 443 / HTTPS |
| GlobalSign Atlas | emea.acme.atlas.globalsign.com | 443 / HTTPS |
| DigiCert | one.digicert.com | 443 / HTTPS |
| SSL.com | acme.ssl.com | 443 / HTTPS |
| ZeroSSL | acme.zerossl.com | 443 / HTTPS |
| Actalis | acme-api.actalis.com | 443 / HTTPS |
| GoDaddy ACME | acme.godaddy.com | 443 / HTTPS |
| Custom / private ACME | Customer-defined directory URL | 443 / HTTPS (or custom) |
Private / on-prem ACME CAs. Every ACME call made on behalf of an existing account — issuance, renewal, order finalisation, ARI refresh, account validation and revocation — deliberately allows RFC1918 (and loopback) destinations, so an internal ACME directory such as step-ca, EJBCA or Pebble works. Link-local addresses, cloud-metadata endpoints and DNS-rebinding are still refused on those calls, and a custom CA root is trusted through LEGO_CA_CERTIFICATES.
LEGO_CA_SYSTEM_CERT_POOL if you use a public CA as wellLEGO_CA_CERTIFICATES replaces the system trust store rather than adding to it. On an instance that issues from a public CA (Let's Encrypt, Sectigo, …) and an internal one, pointing it at your private root alone makes every public-CA call — issuance, ARI refresh and revocation included — fail with x509: certificate signed by unknown authority.
Set both:
LEGO_CA_CERTIFICATES=/etc/certautopilot/private-ca-root.pem
LEGO_CA_SYSTEM_CERT_POOL=true
LEGO_CA_SYSTEM_CERT_POOL has no effect on its own — it requires LEGO_CA_CERTIFICATES. Leave both unset when you only use public CAs: that is the default and it uses the system trust store.
Creating (registering) the account is the one step that keeps the strict stance and will not dial a private address, so an account for an internal CA has to be provisioned out of band today.
Internal issuers (Microsoft AD CS)
On use — only when you issue from Microsoft AD CS via CES/CEP.
| Service | Host | Port |
|---|---|---|
| Microsoft AD CS (CES / CEP, WSTEP/XCEP SOAP) | Customer-defined | 443 / HTTPS |
Revocation checks
Hosts come from the OCSP / CRL extensions inside each CA's certificate chain. They are not fixed up front. The list below is what most public CAs use today; treat it as guidance, not as a closed set.
| Service | Host (typical) | Port |
|---|---|---|
| OCSP responders | ocsp.* hosts of the issuing CA | 80 / HTTP |
| CRL distribution points | crl.* hosts of the issuing CA | 80 / HTTP (sometimes 443) |
DNS providers
Open only the providers you store credentials for.
| Service | Host | Port |
|---|---|---|
| Cloudflare | api.cloudflare.com | 443 / HTTPS |
| AWS Route 53 | route53.amazonaws.com | 443 / HTTPS |
| AWS Lightsail | lightsail.*.amazonaws.com (regional) | 443 / HTTPS |
| Google Cloud DNS | dns.googleapis.com | 443 / HTTPS |
| Azure DNS | management.azure.com, login.microsoftonline.com (service-principal auth; sovereign clouds use the matching login.* + management endpoints) | 443 / HTTPS |
| DigitalOcean | api.digitalocean.com | 443 / HTTPS |
| GoDaddy | api.godaddy.com | 443 / HTTPS |
| UltraDNS | api.ultradns.com | 443 / HTTPS |
| Akamai Edge DNS | *.akamaiapis.net | 443 / HTTPS |
| Hetzner | dns.hetzner.com | 443 / HTTPS |
| OVH | *.api.ovh.com (regional) | 443 / HTTPS |
| Namecheap | api.namecheap.com, api.sandbox.namecheap.com | 443 / HTTPS |
| Hostinger | api.hostinger.com | 443 / HTTPS |
| cPanel / WHM | Customer-defined panel host (:2083 / :2087) | 443 / HTTPS |
| Plesk | Customer-defined Plesk host (:8443) | 443 / HTTPS |
| DirectAdmin | Customer-defined DirectAdmin host (:2222) | 443 / HTTPS |
| RFC 2136 (dynamic DNS update) | Customer-defined DNS server | 53 / TCP + UDP |
| Windows DNS (over WinRM) | Customer-defined Windows DNS server | 5985 / 5986 (WinRM) |
Discovery and domain tracking
On use — these turn on with the matching feature.
| Service | Host | Port |
|---|---|---|
| Certificate Transparency search | crt.sh | 443 / HTTPS |
| WHOIS / domain expiration | Registry-specific (e.g. whois.verisign-grs.com) | 43 / TCP |
| TLS scanner | Customer-defined targets | 443 / TLS (or custom) |
| AXFR zone-transfer source | Vetted DNS servers (allowlisted in settings) | 53 / TCP |
| DNS resolution (forward + reverse) | Configured discovery resolvers | 53 / TCP + UDP |
Notifications
| Service | Host | Port |
|---|---|---|
| Slack incoming webhooks | hooks.slack.com | 443 / HTTPS |
| Microsoft Teams webhooks | *.webhook.office.com, outlook.office.com | 443 / HTTPS |
| SMTP relay (notification) | Customer-defined | 25 / 465 / 587 |
| Webhook notification receiver | Customer-defined | 443 / HTTPS (plain HTTP allowed by operator choice; link-local and cloud-metadata addresses always refused) |
Distribution targets
Customer-defined hosts. Listed by module so the firewall request covers them.
| Module | Host | Port (default) |
|---|---|---|
| SSH | Customer-defined | 22 / SSH |
| WinRM (generic) | Customer-defined | 5985 / 5986 |
| Microsoft IIS | Customer-defined | 5985 / 5986 (WinRM) |
| Kubernetes API | Customer-defined | 443 / 6443 |
| F5 BIG-IP | Customer-defined | 443 / HTTPS |
| Citrix NetScaler | Customer-defined | 443 / HTTPS |
| HashiCorp Vault | Customer-defined | 8200 / HTTPS |
| Webhook | Customer-defined | 443 / HTTPS |
| SMTP delivery | Customer-defined | 25 / 465 / 587 |
| Huawei Cloud (ELB / CDN / WAF) | *.myhuaweicloud.com (regional) | 443 / HTTPS |
| AWS ACM | acm.<region>.amazonaws.com | 443 / HTTPS |
| Cloudflare | api.cloudflare.com | 443 / HTTPS |
| Azure Key Vault | {vault}.vault.azure.net, login.microsoftonline.com (sovereign clouds: {vault}.vault.azure.cn + login.chinacloudapi.cn, or {vault}.vault.usgovcloudapi.net + login.microsoftonline.us) | 443 / HTTPS |
| MerlinCDN | api.merlincdn.com | 443 / HTTPS |
| cPanel / WHM | Customer-defined | 2083 (cPanel) / 2087 (WHM) / HTTPS |
| Microsoft Exchange (on-prem) | Customer-defined | 5985 / 5986 (WinRM) — to every Exchange server the target covers, not only the one named on it, when the target restarts services across an organization |
(Microsoft AD CS is an issuer, not a distribution target — see Internal issuers.)
External secret stores
On use — only when a distribution credential reads its value from an external store instead of storing it locally. The store is contacted on every credential resolution (deploy, dry-run and each health check), never cached, so the value is always current. Both use the same SSRF-guarded dialer (link-local and cloud-metadata addresses are always refused).
| Store | Host | Port (default) |
|---|---|---|
| HashiCorp Vault / OpenBao (KV v1/v2) | Customer-defined | 8200 / HTTPS |
| ManageEngine PAM360 | Customer-defined | 443 / HTTPS |
Post-distribution validation
| Service | Host | Port |
|---|---|---|
| TLS fingerprint check | Customer-defined endpoints | 443 / TLS (or custom) |
Authentication & directory (LDAP)
On use — only when LDAP authentication is configured.
| Service | Host | Port |
|---|---|---|
| LDAP / LDAPS (directory bind + user lookup) | Customer-defined directory server | 389 (LDAP) / 636 (LDAPS) |
Audit log forwarding (syslog)
On use — only when syslog forwarding is enabled (Settings → Syslog).
| Service | Host | Port |
|---|---|---|
| Syslog forwarder (audit trail) | Customer-defined syslog server | 514 / UDP or TCP (or a custom TCP+TLS port) |
Telemetry (optional)
Disabled by default. Only outbound when an OTLP endpoint is configured.
| Service | Host | Port |
|---|---|---|
| OpenTelemetry collector (gRPC) | Customer-defined | 4317 / gRPC, plaintext |
Air-gapped notes
- There is no mandatory always-on egress. A Free or offline-licensed instance never contacts the license host; talk to support for offline license activation if you run online mode today.
- Public ACME CAs are not reachable in an isolated network — issue from Microsoft AD CS or another internal CA instead.
- OCSP / CRL fetches cannot currently be disabled — there is no revocation setting. Route them through an HTTP proxy or block them at the firewall; the check then fails soft.
- WHOIS (port 43) is frequently blocked on enterprise networks; turn off domain expiration tracking if it is.