Communications between Root CA and subs

[sdewis]

Hi All

Maybe someone on here can answer a question that I can't find the answer to on TechNet (quell suprise!)

On my company's wan is a Root CA (microsoft certificate services on Win2003 Ent). This is in site A.

There will be two subordinate CA's installed in Site B and Site C (two sites on cold failover)

We have lots of firewalls in-between the Root and the subs.

Can anyone tell me what firewall ports need to be opened up between site A and B/C?

It uses V3 certs if that makes any difference.

I'm guessing TCP port 135, but I can't find any confirmation of this anywhere.

Cheers

Sean

[geepod]

Well CA's communicate via AD replication either intra site or intersite.

If your AD replication is working then there is no problem, you dont need to open a specific port for CA comms.

We have 4 seperate sites all seperated by firewall and they communicate fine through AD replication.

Unless im missing something in your question ?

[sdewis]

Aaha! Yes, sorry, I forgot to say that the boxes aren't AD integrated.

For security reasons, they can't be on a domain.

[geepod]

sorry i.m confused.

So you have a stand alone root CA (you cant have a enterprise root as that is depenant on AD) which should also be offline) that you want to communicate with B/C ?

What sort of communication do you want to take place and why ?

sorry if im confused

however CA serivces use RPC and DCOM to communicate so port 135 and random ports greater than 1024.

of course u wil aslo need 443 etc for SSL aswell.