6.3. Firewall Configuration

The following table lists the default ports used by Certificate System subsystems:

When you set up Certificate System using the pkispawn utility, you can customize the port numbers. If you use different ports than the defaults listed above, open them correspondingly in the firewall as described in Section 6.3.1, “Opening the Required Ports in the Firewall”. For further details about ports, see Section 5.5.3, “Planning Ports”.

For ports required to access Directory Server, see corresponding section in Opening required ports in the firewall.

To enable communication between the clients and Certificate System, open the required ports in your firewall:

Make sure the firewalld service is running.
```
# systemctl status firewalld
```
To start firewalld and configure it to start automatically when the system boots:
```
# systemctl start firewalld
# systemctl enable firewalld
```
Open the required ports using the firewall-cmd utility. For example, to open the Certificate System default ports in the default firewall zone:
```
# firewall-cmd --permanent --add-port={8080/tcp,8443/tcp,8009/tcp,8005/tcp}
```
For details on using firewall-cmd to open ports on a system, see the Red Hat Enterprise Linux Security Guide or the firewall-cmd(1) man page.
Reload the firewall configuration to ensure that the change takes place immediately:
```
# firewall-cmd --reload
```