The communications required (firewall rules) to enable SWS operations depend on the type of operation performed:
- Make digital signatures (PAdES, CAdES, XAdES)
- Apply timestamp
- Verify digital signatures, timestamps and certificates
To allow SWS to be contacted and used, the following rule must be enabled.
| Protocol | Port | TCP/UDP | Environment |
|---|---|---|---|
| HTTP | 8080 | TCP | TEST, PROD |
The following communications are required.
| Operation | Description | Protocol | Port | TCP/UDP | Address | Environment |
|---|---|---|---|---|---|---|
| Signature | Sends a request to the Namirial server for signing the hash | HTTPS | 443 | TCP | fra.test.firmacerta.it fra.firmacerta.it | TEST PROD |
| Retrieve a list of trusted certificates | Used to download all trusted root certificates | HTTPS | 443 | TCP | swsverifier.test.namirialtsp.com swsverifier.namirialtsp.com | TEST PROD |
NOTE: Communications are protected by mTLS (mutual authentication).
Requires the same communications as Level B plus timestamp service.
| Operation | Description | Protocol | Port | TCP/UDP | Address | Environment |
|---|---|---|---|---|---|---|
| Timestamp | Sends request to Namirial server to apply timestamp to hash | HTTPS | 443 | TCP | timestamp.test.firmacerta.it timestamp.firmacerta.it | TEST PROD |
Requires the same communications as Level B plus certificate validation services.
| Operation | Description | Protocol | Ports | TCP/UDP | Address | Environment |
|---|---|---|---|---|---|---|
| Verification using OCSP | For validate the certificate send request to OCSP for check the certificate | OCSP | 80 | TCP | ocsp.test.firmacerta.it ocsp.test.namirialtsp.com ocsp.firmacerta.it ocsp.namirialtsp.com | TEST PROD |
| Validation using CRL | For validate the signature certificate check the serial number into CRL | HTTP | 80 | TCP | crl.test.firmacerta.it crl.test.namirialtsp.com crl.firmacerta.it crl.namirialtsp.com | TEST PROD |
For level LT signatures, the comunications required are all above and VERY IMPORTANT → if you are signing file already signed from thirdparty company, the comunication outgoing, must be opened worldwide (because is not possible to know the CRL/OCSP endpoint of all CA and they can change also)
Use the same firewall rules required for:
- Level B signatures
- Level T signatures
To verify:
- Digital signatures
- Timestamps
- Certificates
Use the same rules required for Level B signatures.