Skip to content

System requirements · 3.3

Network connectivity

The management host must reach the license server regularly; TLSPilot checks the license once a day. If the license server cannot be reached, TLSPilot keeps working for a grace period: 30 days after the last successful check, or 7 days after the activation if no check has succeeded since then. If the license server reports the license as revoked, for example after a cancelled subscription, the grace period is 7 days from that check, and all licensed features keep working until then. See chapters License and License and activation. All other requirements only apply to the challenge methods and deployment types you use.

ACME challenges

  • DNS-01: Requires a supported DNS provider API, RFC 2136 or manual DNS entries, together with a matching credential.
  • HTTP-01: Requires the CA and TLSPilot to reach port 80 for every domain name in the certificate. The CA connects from several network perspectives, so do not restrict the port to individual IP addresses or countries, see chapter Multi-perspective validation.
  • TLS-ALPN-01: Requires the CA and TLSPilot to reach port 443 on the public IP address of every domain name. The same applies as for HTTP-01, see chapter Multi-perspective validation.
  • All challenges: Require outbound HTTPS access from the management host to the ACME provider.

Deployment targets

  • Windows targets: Require WinRM access from the management host to the target: TCP 5986 (HTTPS, preferred) or TCP 5985 (HTTP with Negotiate encryption), see chapter Appendix: WinRM and SSH setup.
  • Linux targets: Require SSH access from the management host to the target.
  • Azure and Entra ID: Require access from the management host to Microsoft Graph and Azure Resource Manager. Permissions are granted to the app registration used for deployment, not to the signed-in administrator.
  • Other targets: Require access from the management host to the API of the target system, for example of a firewall, an application delivery controller or a cloud service.

Licensing

  • License server: Requires outbound access from the management host to license.itrain.ch on TCP port 443 with TLS 1.3.

Updates

  • Update server: Requires outbound access from the management host to https://download.itrain.ch on TCP port 443 for the update check and the update download. TLSPilot reads https://download.itrain.ch/ITP/latest/latest.json; the installer is on the same host. Without this access, Check for updates and the update download do not work; everything else keeps working. The switch Check for updates on startup in the settings on the tab General applies to all users of the management host.