CredHub Network Communications
This topic describes CredHub internal network communication paths with other Pivotal Application Service (PAS) components.
Inbound Communications
The following table lists network communication paths that are inbound to the CredHub.
| Source VM | Destination VM | Port | Transport Layer Protocol | App Layer Protocol | Security and Authentication |
|---|---|---|---|---|---|
| cloud_controller (api) | credhub | 8844 | TCP | HTTPS | OAuth 2.0 |
| diego_cell | credhub | 8844 | TCP | HTTPS | Mutual TLS† |
| windows_cell | credhub | 8844 | TCP | HTTPS | Mutual TLS† |
| windows2016_cell | credhub | 8844 | TCP | HTTPS | Mutual TLS† |
Outbound Communications
The following table lists network communication paths that are outbound from the CredHub.
| Source VM | Destination VM | Port | Transport Layer Protocol | App Layer Protocol | Security and Authentication |
|---|---|---|---|---|---|
| credhub | uaa | 8443 | TCP | HTTPS | n/a |
| credhub | mysql_proxy* | 3306 | TCP | MySQL | MySQL authentication** |
*Applies only to deployments where internal MySQL is selected as the database.
**MySQL authentication uses the MySQL native password method.
†Diego cells use the certificate pairs generated for individual containers to authenticate with CredHub on behalf of applications.
BOSH DNS Communications
By default, PAS components and app containers look up services using the BOSH DNS service discovery mechanism. To support this lookup, BOSH Director colocates a BOSH DNS server on every deployed VM. For more information, see BOSH DNS Network Communications.