Overview
The CLM Agent is a lightweight binary installed on servers within your internal network. It allows the CLM to communicate with systems that have no direct internet access, such as Microsoft AD CS.
How it works
The agent initiates an outbound connection to the CLM via secure WebSocket (WSS). The server sends commands over the connection and the agent executes them locally, returning the results in real time.
CLM SaaS ←——— WSS (outbound 443) ——— CLM Agent
↕
AD CS Server
(RPC/DCOM)
There is no need to open inbound ports on the firewall — only outbound TCP 443 to the CLM.
Supported platforms
| System | Architecture | Support |
|---|---|---|
| Windows Server 2016+ | amd64, arm64 | ✅ |
| Ubuntu 20.04+ | amd64 | ✅ |
| Debian 11+ | amd64 | ✅ |
| CentOS / RHEL 8+ | amd64 | ✅ |
Network requirements
| Destination | Port | Purpose |
|---|---|---|
| CLM (platform) | 443 TCP (WSS) | Outbound WebSocket to receive commands |
| AD CS Server | 135 TCP + 49152–65535 dynamic TCP | certutil / certreq via DCOM/RPC |
| AD CS Server | 443 TCP (optional) | If CA Web Enrollment is enabled |