Skip to content
IAM built for the AI-Era
Logo

URL Allowlists

This section describes the URLs that must be accessible through the firewall for Specops Password Policy (SPP) installation and Breached Password Protection (BPP Express and BPP Complete).

Note

It is strongly recommended to use URL or hostname-based allowlists, as IP addresses may change over time.

SPP Admin tools and BPP Express

Access to the following sites is required for installing SPP, the admin tools, and BPP Express. In addition, access is needed to the revocation checking endpoints that might be used.

URL Description Protocol Port
https://breach-protection.specopssoft.com Web endpoint TCP 443
https://download.specopssoft.com Web endpoint TCP 443

For certificate revocation checks, allow access to the applicable Certificate Issuers and CRL Endpoints.

BPP Complete

All Arbiter servers need https access to https://breach-protection.specopssoft.com, and the revocation checking endpoints that might be used.

URL Description Protocol Port
https://breach-protection.specopssoft.com Web endpoint TCP 443

For certificate revocation checks, allow access to the applicable Certificate Issuers and CRL Endpoints.

It is strongly recommended to use URL or hostname-based allowlists, but if you have to use IP address rules, make sure you allow Arbiters access to the following IP address spaces. More granular filtering is not supported, as exact IP addresses within these ranges are subject to change at any time.

  • 138.91.126.220/30
  • 40.71.57.208/29
  • 52.180.65.88/29
  • 13.79.75.152/29
  • 74.234.213.168/29

Certificate Issuers and CRL Endpoints

Certificate revocation list (CRL) endpoints for all issuers may change over time. Allow access to the CRL endpoints used by the certificates being validated. Always refer to the official source documentation for each issuer for the most up-to-date information. Microsoft certificates may be issued by different intermediate certificate authorities (CAs), for example, Azure ECC TLS Issuing CA 03 through 08. See Microsoft PKI Repository for the full list.

Issuer CRL endpoint Protocol Port Source documentation
Let's Encrypt https://*.c.lencr.org TCP 443 Let's Encrypt Certificates
Let's Encrypt http://*.c.lencr.org TCP 80 Let's Encrypt Certificates
GoDaddy https://crl.godaddy.com TCP 443 GoDaddy Repository
GoDaddy http://crl.godaddy.com TCP 80 GoDaddy Repository
Microsoft http://www.microsoft.com/pkiops/crl/* TCP 80 Microsoft PKI Repository
Amazon http://*.amazontrust.com TCP 80 Amazon Trust Services Repository
Amazon http://*.amznts.eu TCP 80 Amazon Trust Services Repository