About Outbound Communications

Imprivata Appliance

A fully licensed and enabled Imprivata appliance needs to contact the remote communication sites identified below to communicate with licensed services such as Imprivata Insight, Imprivata Cloud Token Service, Imprivata Enterprise Access Management for MFA (formerly Imprivata Confirm ID), and log transmittal.

Port	Protocol	Direction	Host	Description
443	HTTPS	Outbound	icps.imprivata.com	Enterprise Access Management (Confirm ID) certificate server. Used when initially configuring the Imprivata Confirm ID certificate
443	HTTPS	Outbound	osmul.imprivata.com	Enterprise Access Management (OneSign) Insight metrics server. Collects Insight data
443	HTTPS	Outbound	oslful.imprivata.com	Imprivata Support log file server. Used when submitting log files directly from Imprivata Appliance Console only when requested by Imprivata Support
443	HTTPS	Outbound	rpapi.cts.imprivata.com	Imprivata Cloud Token Service. Used by Enterprise Access Management for user services
443	HTTPS	Outbound	api.digicert.com	DigiCert server required for Individual identity proofing
	HTTP	Outbound	http://ocsp.digicert.com	DigiCert server required for revocation checking via the online certificate status protocol
	HTTP	Outbound	http://ocsptest.digicert.com	Non-production DigiCert server for revocation checking via the online certificate status protocol. For test computers only. 1 Test computers in a non-production enterprise use a test DigiCert server for revocation checking. If communication to the test DigiCert host is blocked, the user may see an alert in the Imprivata Admin Console that the DigiCert service is down. Functionality is not blocked; revocation checking will not occur.
443	HTTPS	Outbound	www.digicert.com	DigiCert identity proofing: required to access the token URL in the enrollment utility.
443	HTTPS	Outbound	*.amazonaws.com 2 It is not currently possible to allowlist a specific URL. Perform the configuration according to the documentation and add *.amazonaws.com to the allowlist. The URL to the AWS bucket is dynamic.	A connection to Amazon S3 is needed for the Imprivata appliance to update the DigiCert metadata (e.g. the client certificate). This is required for Individual identity proofing of new users. 3 Test computers in a non-production enterprise use a test DigiCert server for revocation checking. If communication to the test DigiCert host is blocked, the user may see an alert in the Imprivata Admin Console that the DigiCert service is down. Functionality is not blocked; revocation checking will not occur.
443	HTTPS	Outbound	*.cloud.imprivata.com	Connection to the Imprivata Cloud, allows communication from users outside the firewall to Enterprise Access Management inside the firewall.
443	HTTPS	Outbound	*.sys.imprivata.com 4 For non-US regions, replace the .com with the appropriate domain suffix for your region. For example: *.sys.imprivata.uk. *.app.imprivata.com	Connection to the production Imprivata Cloud Platform Used for single sign-on to the Imprivata Access Management Portal.

Certificate Revocation Checking and Outbound Communication on TCP Port 80

Imprivata cloud services rely on standard TLS certificate validation performed by the client platform. Depending on the operating system, browser, connector, application, and local security policy, certificate validation may include revocation checking for the TLS certificates used to establish trusted connections. During certificate validation, the client may retrieve certificate revocation information from the issuing Certificate Authority (CA)."

The location of this information is published in the certificate itself:

• The CRL Distribution Points (CDP) extension names where the Certificate Revocation List (CRL) can be downloaded

• Where applicable, the Authority Information Access (AIA) extension names the OCSP responder that can be queried for a certificate's status.

The revocation data itself is not carried in the certificate; the client uses these pointers to fetch it from the CA's endpoints.

Some of those CA revocation endpoints are published as HTTP URLs and therefore require outbound access over TCP port 80.

• This port 80 access is used only to retrieve CA-published certificate status information (CRLs or OCSP responses).

• It is separate from the encrypted application connection to Imprivata cloud services, which uses HTTPS/TLS.

Administrators who restrict outbound HTTP traffic should allow outbound TCP port 80 only from the systems that connect to Imprivata cloud services, and only to the CA revocation endpoints required by the certificate chain.

• Identify these endpoints from the CRL Distribution Points and Authority Information Access fields in the relevant certificates, or from the issuing CA's published revocation-service documentation.

• Enforce the restriction through firewall, secure web gateway, or explicit proxy rules that allow only the required CA hostnames and revocation paths.

• Allowlist by fully qualified hostname (FQDN), not by IP address.

  CA revocation endpoints are frequently served from content delivery networks whose IP addresses change without notice; an IP-based rule will break silently when the CA rotates infrastructure.

  General outbound web browsing over port 80 is not required, and no inbound port 80 access to the customer environment is required for this purpose.

Do not disable certificate revocation checking to work around blocked CRL or OCSP access. If a system cannot reach the required CA revocation endpoints, one of two things happens depending on the client's revocation policy:

• Validation may hard-fail, and the connection is refused;

• Validation may soft-fail, and the connection proceeds without confirming revocation status, silently weakening the protection the check was meant to provide.

Disabling revocation checking guarantees the second, weaker outcome for every connection.