> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/getting-started/deployment-guide/networking-dns-and-tls.md).

# Networking DNS and TLS

## DNS

Create DNS records for the Auth, Admin and Self-Service endpoints. For a private cloud deployment, use an internal DNS zone or your existing internal DNS infrastructure — the portal does not need to resolve publicly.

Allocate a fully qualified domain name for the portal endpoint before you request the certificate.

## TLS

Install a valid TLS certificate for the portal endpoint, issued by either your internal certificate authority or a public one. The certificate must carry the portal FQDN as its Common Name or as a Subject Alternative Name.

Terminate HTTPS at the reverse proxy and enforce TLS 1.2 or 1.3 for all client and inter-service traffic.

## Ports

Open these between the components. This is the deployment subset; the full port and protocol matrix, including PAM target and inter-datacentre traffic, is in *Operations → Service and port reference*.

| Direction | Source               | Destination               | Protocol | Port      | Purpose                              |
| --------- | -------------------- | ------------------------- | -------- | --------- | ------------------------------------ |
| Inbound   | End-user network     | Application server        | TCP      | 443       | HTTPS portal and administration      |
| Inbound   | Bastion or jump host | Both servers              | TCP      | 3389 / 22 | RDP or SSH administration            |
| Internal  | Application server   | Database server           | TCP      | 5432      | PostgreSQL                           |
| Internal  | Application tier     | Directory                 | TCP      | 636       | LDAPS identity lookup                |
| Outbound  | Application server   | SMTP relay                | TCP      | 25 or 587 | Email notifications and OTP          |
| Outbound  | Application server   | SMS gateway               | TCP      | 443       | SMS MFA delivery                     |
| Outbound  | Application server   | NTP source                | UDP      | 123       | Time synchronisation                 |
| Outbound  | Application server   | Internet or internal repo | TCP      | 443       | OS updates, Java and Tomcat packages |

Where RADIUS is used for network device authentication, also open UDP 1812 and 1813, or TCP 2083 for RadSec.

## Time synchronisation

{% hint style="warning" %}
Synchronise every host to a common time source. This is not optional housekeeping — inconsistent time between the application and database servers causes authentication and session failures, and OTP, TOTP and certificate validation all depend on it.
{% endhint %}

In Azure, the host-provided time synchronisation is acceptable.