General Requirements

• Inbound communication mode: Jamf Pro 10.40.0 or later

  Note:

  Ensure all web applications in clustered environments are able to communicate with the configured Jamf AD CS Connector. In addition, the connector must be publicly resolvable to allow Jamf Cloud-hosted instances of Jamf Pro to connect to it.

• Outbound communication mode: Jamf Pro 11.13.0 or later

To use outbound communication mode, an API role and an API client must be configured in Jamf Pro. You will need the client ID, client secret, Jamf Pro URL, and AD CS integration ID when configuring the Jamf AD CS Connector.

For more information, see API Roles and Clients in the Jamf Pro Documentation.

• Windows Server 2019 or 2022 joined to a domain that has a trust relationship with the domain of the certificate authority

  For more information about joining the server to a domain that has a trust relationship with the domain of the certificate authority, see the Joining Server Computers to the Domain and Logging On documentation from Microsoft.

• .NET Framework 4.8 or later

  To download the .NET Framework, go to Download .NET Framework.

• PowerShell 5.1 or later (for the installation script)

• Internet Information Services (IIS) (inbound only)

• DCOM —

  The Jamf AD CS Connector uses Microsoft Distributed Component Object Model (DCOM) to communicate with AD CS. You must have the following TCP ports open for this communication:

  • 135

  • 49152-65535

  For more information about DCOM, see the [MS-DCOM]: Distributed Component Object Model (DCOM) Remote Protocol documentation from Microsoft.

• HTTPS (inbound) — Jamf Pro initiates HTTPS connections with the Jamf AD CS Connector, typically on TCP port 443. The HTTPS port must be opened, inbound on the following:

  • Your network firewall

  • The Windows Firewall running on the server on which the Jamf AD CS Connector is installed

• HTTPS (outbound) —

  The server hosting the Jamf AD CS Connector must be able to access Jamf Pro, typically on TCP port 443.

• TLS (inbound) —TLS 1.2 is required. TLS 1.3 is not supported. If you are using TLS 1.3 on your Windows server, you must disable it and enable TLS 1.2 to avoid connection interruptions.
• TLS (outbound) —Jamf recommends using TLS 1.3. TLS 1.2 is supported.

The Jamf AD CS Connector host must be bound to the domain, so the ports required by Microsoft to support binding should be open between the Jamf AD CS Connector host and AD domain controller.

For more information, see the following articles: