In diesem Verzeichnis sind kryptografische Verfahren und deren Einsatz nach bestem Wissen und mit momentanem Kenntnisstand erfasst. Ziel ist es, einen Überblick zu geben und die Sicherheit der damit umgesetzten Maßnahmen zu gewährleisten.
Dieses Verzeichnis unterliegt Änderungen.

Aktualisiert am: 27.08.2026 14:04 UTC

ProCall

ProCall ist eine Software für Unified Communications und Collaboration von estos. Sie bündelt Telefonie, Audio- und Videokommunikation sowie Chat in einer einzigen Oberfläche und stellt Funktionen wie
Anzeige des Anwesenheitsstatus (Präsenzmanagement), Computer-Telefonie (CTI), Softphone, Chat und Videokonferenzen, zum Beispiel über ProCall Meetings, zur Verfügung.
Über MetaDirectory, ECSTA, Groupware und weitere Schnittstellen können außerdem weitere Systeme wie Telefonanlagen oder CRM- und ERP-Systeme angebunden werden.

UCServer

Windows-Dienst EUCSrv.exe (ProCall UCServer). Zentrale Plattform für CTI, Präsenz, Chat, SIP/AV, Federation und Client-Verbindungen.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Remote TSP / MultiLine TSP Verbindung zu einem Remote TAPI Treiber und einem MultiLine TAPI Treiber.	—	TCP → TLS (1.0, 1.1, 1.2) → Proprietary binary protocol to transport TAPI structures	estos Crypto SSPI Server\	7220
UCServer Verwaltung Management interface.	—	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	estos Crypto SSPI Server\	7221
Client connection interface Used by ProCall Client, Update Service, SDK	—	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	estos Crypto SSPI Server\	7222
Server search (e.g. from Windows Clients) via Broadcast	—	UDP → Proprietary XML	—	7230
Direkte XMPP S2S-Föderation	Nur Direktmodus (ProxyEnabled=false). Bei Proxy-Modus kein S2S-Listener am UCServer — EXmppFedServer::InitNet bindet stattdessen an UCXMPPProxy (5275). Entweder/Oder, nicht parallel.	TCP → TLS (1.0, 1.1, 1.2) → XMPP	estos Crypto SSPI Server\	5269
Default for SIP over TCP	Nur Direktmodus (Open Federation, EdgeServerEnabled=0). SIP-Föderation über TCP. Bei Edge-/Proxy-Modus kein Föderations-Listener — UCServer bindet sich an UCSIPProxy.	TCP → SIP	—	5060
Default for SIP over TLS/MTLS (Federation)	Nur Direktmodus (Open Federation, EdgeServerEnabled=0). SIP-Föderation über TLS/mTLS. Bei Edge-/Proxy-Modus kein Föderations-Listener — UCServer bindet sich an UCSIPProxy (EdgeAddress/EdgePort). PBX-TLS unabhängig davon.	TCP → TLS (1.0, 1.1, 1.2) → SIP	estos Crypto SSPI Server\	5061

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
Active Directory	LDAP (ohne TLS)	—	TCP	—	389
Active Directory	LDAPS (TLS)	—	TCP → TLS (1.0, 1.1, 1.2) → LDAPS	estos Crypto SSPI Client\	636
MetaDirectory	MetaDirectory LDAP server interface	—	TCP → LDAP	—	712
MetaDirectory	MetaDirectory LDAPS server interface	—	TCP → TLS (1.0, 1.1, 1.2) → LDAPS	estos Crypto SSPI Client\	714
SIP PBX	SIP Registrar und Trunk UDP (ohne Verschlüsselung) Trunk nicht in Infinity verfügbar	—	UDP	—	5060
SIP PBX	SIP Registrar und Trunk UDP (DTLS)	—	UDP → DTLS	—	5060
UCConnect	Inbound REST API receiving push notification jobs from UCServer and UCConnect services. TLS at nginx :443; backend ucpush:3006. Routes: /push/api/, /push/healthcheck/, /push/dnshealth.	—	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443
ProCall	Verschlüsselte Schnittstelle zum Server für Verbindungen über das Web	—	TCP → TLS (1.2, 1.3) → estos ASN.1/JSON	estos Crypto SSPI Client\	7225
SMTP Server	SMTP message submission (SUBMISSION)	SMTP AUTH credentials configured in UCServer E-Mail dispatch	TCP → TLS (1.2, 1.3) → SMTP	estos Crypto SSPI Client\	587
SIP PBX	SIP Registrar und Trunk TCP	SIP-Signalisierung zur PBX über TCP (Port 5060).	TCP	—	5060
SIP PBX	SIP Registrar und Trunk TLS	SIP-Signalisierung zur PBX über TLS (Port 5061).	TCP → TLS (1.2, 1.3) → SIP	estos Crypto SSPI Client\	5061
Microsoft SQL Server	SQL Server ODBC (TLS)	UCServer-Datenbankverbindung (Microsoft SQL Server).	TCP → TLS (1.2, 1.3) → ODBC	estos Crypto SSPI Client\	1433
Redis 8	Redis RESP (TLS)	—	TCP → TLS (1.2, 1.3) → RESP	Windows SSPI Client\	6379
Sentry	Sentry HTTPS (error reporting)	UCServer sendet Crash-/Fehlerberichte an Sentry. TLS-Version ergibt sich aus Handshake mit dem Server.	TCP → TLS (1.2, 1.3) → HTTPS	estos Crypto SSPI Client\	443
UCConnect	UCConnect cloud controller for UCServer registration and routing	Production endpoint: uccontroller.ucconnect.de.	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443
UCConnect	UCConnect cloud UCWeb instance for mobile/web client bridging	Production endpoint pattern: ucweb-ucweb[N]-0.ucconnect.de.	TCP → TLS (1.2, 1.3) → WebSocket	estos Crypto SSPI Client\	443
UCConnect	TURN credential provisioning for UCServer-mediated WebRTC	Production endpoint: ucturnapi.ucconnect.de.	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443
UCConnect	Per-tenant meta.ucconnect.de endpoint for cloud UCWeb routing	Production: *.{tenant}.meta.ucconnect.de on port 7224. TLS terminated by ucweb (not nginx).	TCP → TLS (1.2, 1.3) → WebSocket	estos Crypto SSPI Client\	7224
UCConnect	LDAP directory lookups against cloud UCWeb MetaDirectory (UCConnect mode)	Production: UCWeb VM port 714/tcp, LDAP over TLS with SNI ({ucsid}.meta.ucconnect.de)	TCP → TLS (1.2, 1.3) → LDAP	estos Crypto SSPI Client\	714
ProCall	UCServer registriert sich am UCXMPPProxy (XEP-0114, Port 5275)	Nur Proxy-Modus (ProxyEnabled=true). Schließt direkte Föderation auf 5269 und Outbound be2f34a4 am UCServer aus.	TCP → XMPP	—	5275
XMPP Server	Outbound XMPP S2S zum Föderationspartner	Nur Direktmodus (ProxyEnabled=false). Im Proxy-Modus übernimmt UCXMPPProxy den Outbound zu be2f34a4.	TCP → TLS (1.2, 1.3) → XMPP	estos Crypto SSPI Client\	5269
ProCall	UCServer registriert sich am UCSIPProxy (Edge-Server, TLS 5061)	Nur Edge-/Proxy-Modus (EdgeServerEnabled=1, EdgeProtocol=TLS/mTLS). Schließt direkte SIP-Föderation und Outbound 526a87c7 am UCServer aus.	TCP → TLS (1.0, 1.1, 1.2) → SIP Federation	estos Crypto SSPI Client\	5061
ProCall	UCServer registriert sich am UCSIPProxy (Edge-Server, TCP 5060)	Nur Edge-/Proxy-Modus (EdgeServerEnabled=1, EdgeProtocol=TCP). Schließt direkte SIP-Föderation und Outbound 526a87c7 am UCServer aus.	TCP → SIP Federation	estos Crypto SSPI Client\	5060
SIP Federation	Outbound SIP-Föderation zum externen Partner (TLS 5061)	Nur Direktmodus (Open Federation, EdgeServerEnabled=0). Im Edge-/Proxy-Modus übernimmt UCSIPProxy den Outbound zu 526a87c7.	TCP → mTLS (1.2, 1.3) → SIP Federation	estos Crypto SSPI Client\	5061

MediaServer

Forked Kurento-basierter Media Server (Linux/Fedora), gesteuert durch UCServer. Control 8888/tcp, TLS REST/WSS 8433, WebRTC/SRTP 1024-65535. Build: github.com/estos/estos-kurento-scripts.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Control port for the MediaServer	—	TCP	—	8888
Control port for the MediaServer	Custom self signed certificate support. Since UCWeb 8.37.1105-main. (12.06.2026) Cipher suites tested with: openssl ciphers -v Build with https:\/\/github.com/estos/estos-kurento-scripts	UDP → DTLS (SSLv3, 1.2) → REST \| WSS	estos Kurento / GStreamer / OpenSSL 1.0.3-dev Server\	8433
Media	—	UDP → SRTP → SRTP	estos Kurento / GStreamer / OpenSSL 1.0.3-dev Server SRTP\	1024-65535
WebRTC Media for clients	Cipher suites tested with: openssl ciphers -v Build with https:\/\/github.com/estos/estos-kurento-scripts	UDP → DTLS (SSLv3, 1.2) → WebRTC Media	estos Kurento / GStreamer / OpenSSL 1.0.3-dev Server\	1024-65535

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
UCConnect	Primary STUN/TURN UDP listener	—	UDP	—	3478
UCConnect	Primary STUN/TURN TCP listener (UDP fallback)	—	TCP	—	3478
UCConnect	TURN over DTLS alternative listener on port 443	—	UDP → DTLS (1.2) → TURN/STUN	coturn/coturn:4.6.3 (OpenSSL bundled)	443
UCConnect	TURNS (TLS) alternative listener on port 443	—	TCP → TLS (1.2, 1.3) → TURN/STUN	coturn/coturn:4.6.3 (OpenSSL bundled)	443
SIP PBX	RTP Audio Stream	—	UDP → RTP	—	1025-65535
SIP PBX	SRTP Audio Stream	—	UDP → SRTP → SRTP	estos Kurento / GStreamer / OpenSSL 1.0.3-dev Client\	1025-65535

ProCall Desktop for Windows

Nativer ProCall UCClient für Microsoft Windows

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Schnittstelle für Clients zum Finden des UCServers	—	UDP → Proprietary XML	—	7231
WebRTC Media (host candidates) von und zu Clients/Media Server (Audio/Video, Softphone, Bildschirmfreigabe) (1024-65535, in/out)	—	UDP	—	1024-65535

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
Active Directory	LDAP (ohne TLS)	—	TCP	—	389
MetaDirectory	MetaDirectory LDAP server interface	—	TCP → LDAP	—	712
MetaDirectory	MetaDirectory LDAPS server interface	—	TCP → TLS (1.0, 1.1, 1.2) → LDAPS	estos Crypto SSPI Client\	714
ProCall	Client connection interface Used by ProCall Client, Update Service, SDK	—	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	estos Crypto SSPI Client\	7222
ProCall	Schnittstelle zum Server für Verbindungen über das Web	—	TCP → ASN.1/JSON	—	7224
ProCall	Verschlüsselte Schnittstelle zum Server für Verbindungen über das Web	—	TCP → TLS (1.2, 1.3) → estos ASN.1/JSON	estos Crypto SSPI Client\	7225
UCConnect	Primary STUN/TURN UDP listener	—	UDP	—	3478
UCConnect	Primary STUN/TURN TCP listener (UDP fallback)	—	TCP	—	3478
UCConnect	Public HTTPS/WebSocket entry at uccontroller.ucconnect.de; nginx → uccontroller:8224 with selective ucapi/license proxies.	—	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443
Sentry	Sentry HTTPS (error reporting)	UCClient sendet Fehlerberichte an Sentry. TLS-Version ergibt sich aus Handshake mit dem Server.	TCP → TLS (1.2, 1.3) → HTTPS	estos Crypto SSPI Client\	443
Google API	Google REST API Fetches individual personal information from Google contacts and calendar entries.	Used Google.Apis 1.55.0 https:\/\/www.nuget.org/packages/google.apis/1.55.0	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443
ProCall Meetings	HTTPS API und WebSocket (Signaling) via nginx auf ECS, erreichbar über HAProxy lb.*meetings.procall.de:443	—	TCP → TLS (1.2, 1.3) → REST → WebSocket	estos Crypto SSPI Client\	443
DNS Server	DNS SRV/ A/AAAA lookup (UC Server discovery, hostname resolution) E.g. DnsQuery_W für _ctiserver._tcp.<domain>; GetAddrInfoW für Hostnamen	—	UDP → DNS	—	53
Microsoft 365	Graph API	—	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443
HCL Domino	HCL Notes NRPC	—	TCP → NRPC	—	1352
ODBC-Datenquelle	—	—	TCP → TLS (1.2, 1.3) → ODBC \| TDS	estos Crypto SSPI Client\	1433
UCConnect	UCConnect cloud UCWeb WebSocket bridge for ProCall desktop client	Production endpoint pattern: ucweb-ucweb[N]-0.ucconnect.de. Native Windows client TLS via Schannel/SSPI.	TCP → TLS (1.2, 1.3) → WebSocket	estos Crypto SSPI Client\	443
UCConnect	TURN credential provisioning for WebRTC softphone	Production endpoint: ucturnapi.ucconnect.de.	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443
UCConnect	UCConnect REST API for cloud service integration	Production endpoint: ucwebapi.ucconnect.de.	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443
UCConnect	TURN over DTLS on coturn primary TLS port	Production: turn[N].ucconnect.de:5349/udp.	UDP → DTLS (1.2) → TURN/STUN	WebRTC DTLS Client (libwebrtc / BoringSSL)\	5349
UCConnect	TURNS on coturn primary TLS port	Production: turn[N].ucconnect.de:5349/tcp.	TCP → TLS (1.2, 1.3) → TURN/STUN	WebRTC TURNS TLS Client (libwebrtc / BoringSSL)\	5349
UCConnect	TURN media relay after session allocation	Production: turn[N].ucconnect.de ports 49152-65535/udp.	UDP → TURN relay	—	49152-65535
UCConnect	TURNS on coturn alt TLS port 443	Production: turn[N].ucconnect.de:443/tcp.	TCP → TLS (1.2, 1.3) → TURN/STUN	WebRTC TURNS TLS Client (libwebrtc / BoringSSL)\	443
UCConnect	TURN over DTLS on coturn alt TLS port 443	Production: turn[N].ucconnect.de:443/udp.	UDP → DTLS (1.2) → TURN/STUN	WebRTC DTLS Client (libwebrtc / BoringSSL)\	443

Update-Dienst Client

Portfreigaben für ProCall Enterprise/Infinity Komponenten. Quelle: estos Produktdokumentation (Ports und Netzwerkschnittstellen).

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Eingehende UDP-Pakete vom Update-Server am UCServer	—	UDP	—	7232

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	Client connection interface Used by ProCall Client, Update Service, SDK	—	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	estos Crypto SSPI Client\	7222

Contact Portal or LiveChat

Browser-basiertes Kontaktportal und LiveChat für externe Besucher. Kein eigener Listener — konsumiert UCWeb On-Premises (7224/7225) und MediaServer.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	Schnittstelle zum Server für Verbindungen über das Web	—	TCP → ASN.1/JSON	—	7224
ProCall	Verschlüsselte Schnittstelle zum Server für Verbindungen über das Web	—	TCP → TLS (1.2, 1.3) → estos ASN.1/JSON	Browser TLS Client (Chromium / Firefox / Safari)\	7225
UCConnect	Primary STUN/TURN UDP listener	—	UDP	—	3478
UCConnect	Primary STUN/TURN TCP listener (UDP fallback)	—	TCP	—	3478
UCConnect	TURN over DTLS alternative listener on port 443	—	UDP → DTLS (1.2) → TURN/STUN	coturn/coturn:4.6.3 (OpenSSL bundled)	443
UCConnect	TURNS (TLS) alternative listener on port 443	—	TCP → TLS (1.2, 1.3) → TURN/STUN	coturn/coturn:4.6.3 (OpenSSL bundled)	443
UCConnect	Public HTTPS/WebSocket entry at uccontroller.ucconnect.de; nginx → uccontroller:8224 with selective ucapi/license proxies.	—	TCP → TLS (1.2, 1.3) → REST	Browser TLS Client (Chromium / Firefox / Safari)\	443
UCConnect	Inbound REST API receiving push notification jobs from UCServer and UCConnect services. TLS at nginx :443; backend ucpush:3006. Routes: /push/api/, /push/healthcheck/, /push/dnshealth.	—	TCP → TLS (1.2, 1.3) → REST	Browser TLS Client (Chromium / Firefox / Safari)\	443

SIP-Proxy (Federation)

SIP-Federation-Proxy (UCSIPProxy.exe, Windows-Dienst). Alternative zum Direktmodus am UCServer — beide Modi schließen sich gegenseitig aus. Terminiert SIP-Federation auf 5060/5061; UCServer bindet sich per Edge-Server-Konfiguration an.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
SIP-Federation TCP (in/out)	Port 5060. Nur im Edge-/Proxy-Modus am UCSIPProxy aktiv — ersetzt direkten UCServer-Federation-Listener b78ea268. UCServer konsumiert dieses Interface per Edge-Server-Konfiguration (REGISTER).	TCP → SIP Federation	—	5060
SIP-Federation TLS/mTLS (in/out)	Port 5061. Nur im Edge-/Proxy-Modus am UCSIPProxy aktiv — ersetzt direkten UCServer-Föderations-Listener a18e36ad. Outbound zum externen Partner über Consumer 526a87c7.	TCP → TLS (1.0, 1.1, 1.2) → SIP Federation	estos Crypto SSPI Server\	5061

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
SIP Federation	SIP-Federation über TLS/mTLS	—	TCP → mTLS (1.2, 1.3) → SIP Federation	estos Crypto SSPI Client\	5061

XMPP Proxy (Federation)

Der XMPP-Federation-Proxy (UCXMPPProxy.exe) läuft als Windows-Dienst und stellt eine Alternative zum Direktmodus am UCServer dar. Beide Betriebsarten können nicht gleichzeitig verwendet werden. Der Proxy terminiert die XMPP-S2S-Verbindung über TCP-Port 5269 und nimmt die Registrierung des UCServers über TCP-Port 5275 gemäß XEP-0114 entgegen.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
XMPP S2S-Föderation (in/out)	Port 5269 (XMPPPORT_DEF_S2S). Nur im Proxy-Modus am UCXMPPProxy aktiv — ersetzt den direkten UCServer-Listener 44e36d59. Entweder Proxy oder Direktmodus am UCServer, nicht beides.	TCP → XMPP	—	5269
UCServer-Registrierung (XEP-0114 Component)	Port 5275 (XMPPPORT_DEF_XEP114). Nur im Proxy-Modus: UCServer konsumiert dieses Interface (a236b328). Schließt direkte UCServer-Föderation auf 5269 aus.	TCP → XMPP	—	5275

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	XMPP S2S-Föderation (in/out)	—	TCP → XMPP	—	5269
XMPP Server	Standard-XMPP S2S-Schnittstelle (Server-to-Server)	—	TCP → TLS (1.2, 1.3) → XMPP	estos Crypto SSPI Client\	5269

UCWeb On-Premises

Node.js-basierter Web-Proxy zwischen Mobile/Web-Clients und UCServer. Ports 7224 (HTTP/ASN.1-JSON) und 7225 (TLS). Node-Quellen extern (estosnet/UCWeb/services-Repo); nativer EUCWeb-Windows-Service schreibt eucwebconfig.json.

Core

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Schnittstelle zum Server für Verbindungen über das Web	—	TCP → ASN.1/JSON	—	7224
Verschlüsselte Schnittstelle zum Server für Verbindungen über das Web	Welche Cipher-Suites verfügbar sind, hängt von der Node.js-Version und dem Betriebssystem ab. Diese Liste basiert auf einer aktuellen Node.js-Version und Microsoft Windows Server 2022 als Betriebssystem. Scanned with: https:\/\/github.com/rbsec/sslscan ./sslscan ucs.estos.de:7225	TCP → TLS (1.2, 1.3) → estos ASN.1/JSON	NodeJS 24.13.1 Windows On-Premises\	7225

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	Control port for the MediaServer	—	TCP	—	8888
Microsoft SQL Server	The Tabular Data Stream (TDS) protocol versions 7 and 8 is an application layer request/response. https:\/\/learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tds/b46a581a-39de-4745-b076-ec4dbb7d13ec	UCWeb-Datenbankverbindung über tedious/sequelize.	TCP → TLS (1.2, 1.3) → TDS	NodeJS 24.13.1 Windows OnPremise Client\	1433

EUCWeb Windows Service

No interfaces.

Crashpad Handler

Provides product information for an error reporting system.

Used by several products: UCServer, Admin, ProCall and ECSTA

Examples of use:
- UCServer installer: Saves the file “crashpad_handler.exe”
- UCServer start-up: Launches “crashpad_handler.exe” during initialisation
- UCServer crash: “crashpad_handler.exe” collects UCServer dumps and transmits them to an error reporting system. For example, to our self-hosted Sentry instance

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
Sentry	Sentry HTTPS (error reporting)	—	TCP → TLS (1.2, 1.3) → HTTPS	estos Crypto SSPI Client\	443

ProCall UCServer Administrator

UCServer Verwaltung ist eine MFC-Anwendung, mit der die ProCall-Installation (UCServer) konfiguriert wird.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	UCServer Verwaltung Management interface.	—	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	estos Crypto SSPI Client\	7221

ExternalServiceProvider

Microsoft Teams Presence Provider (ExternalServiceProvider
ExternalServiceProvider.exe). Wird vom UCServer gestartet; authentifiziert per asnExternalServiceProviderAuthentication.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
Microsoft 365	Graph API	—	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443
ProCall	Client connection interface Used by ProCall Client, Update Service, SDK	—	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	estos Crypto SSPI Client\	7222

ChatGPT

ChatGPT-Connector (ChatGPT
ChatGPT.exe). Registriert einen ChatGPT-Benutzer am UCServer und leitet Nachrichten an die Azure OpenAI API weiter.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	Client connection interface Used by ProCall Client, Update Service, SDK	—	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	estos Crypto SSPI Client\	7222
ChatGPT	Azure AI API	Library used for connection https:\/\/www.nuget.org/packages/Azure.AI.OpenAI/2.1.0?_src=template	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443

Arbeitsplatz Setup

Arbeitsplatz-Setup (ClnInst.exe) — MFC-Konfigurationsassistent für ProCall-Client am Arbeitsplatz. Ermittelt UCServer per Broadcast (7230/7231), konfiguriert Client-Verbindung (7222) und UCWeb (7224/7225)

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
für Suche nach einem UCServer als Antwortkanal	—	UDP → Proprietary XML	—	7231

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	Client connection interface Used by ProCall Client, Update Service, SDK	—	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	estos Crypto SSPI Client\	7222
ProCall	Schnittstelle zum Server für Verbindungen über das Web	—	TCP → ASN.1/JSON	estos Crypto SSPI Client\	7224
ProCall	Verschlüsselte Schnittstelle zum Server für Verbindungen über das Web	—	TCP → TLS (1.2, 1.3) → estos ASN.1/JSON	estos Crypto SSPI Client\	7225
ProCall	Server search (e.g. from Windows Clients) via Broadcast	—	UDP → Proprietary XML	—	7230
ProCall Meetings	HTTPS API und WebSocket (Signaling) via nginx auf ECS, erreichbar über HAProxy lb.*meetings.procall.de:443	—	TCP → TLS (1.2, 1.3) → REST → WebSocket	estos Crypto SSPI Client\	443

UM Replicator

User Management Replikator (UMReplicator) für Anbindung von LDAP Datenquellen als Benutzerverwaltungs-Backend. Verbindet sich als Client mit UCServer Port 7222.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	ROSE/ASN.1-Verbindung zum UCServer	Default port 7222 in umreplicator_AD.xml / umreplicator_MD.xml	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	estos Crypto SSPI Client\	7222

EWS Calendar Service

EWS Calendar Service (EEWSCalSvc) mit CalendarReplicator.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	UCServer-Verbindung für Kalenderreplikation	Port 7222 in calendarreplicationconfig.xml	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	estos Crypto SSPI Client\	7222

ECSTA Proxy

ECSTA-Proxy (integriert in UCServer/TAPI-Stack). Verbindet sich mit dem separaten uaCSTA-Server-Produkt (System ECSTA). Nicht zu verwechseln mit dem standalone uaCSTA Server.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ECSTA	CSTA/SIP-Verbindung zum uaCSTA Server	Port 5080/tcp — ECSTA zu uaCSTA	TCP → SIP	estos Crypto SSPI Client\	5080
ECSTA	Verschlüsselte CSTA/SIP-Verbindung zum uaCSTA Server	Port 5081/tcp — ECSTA zu uaCSTA (TLS)	TCP → TLS (1.0, 1.1, 1.2) → SIP	estos Crypto SSPI Client\	5081

ProCall Web

ProCall als App for Web stellt ProCall Funktionen plattformunabhängig direkt im Browser zur Verfügung.

ProCall Web

ProCall als App for Web: stellt ProCall Funktionen plattformunabhängig direkt im Browser zur Verfügung

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	Schnittstelle zum Server für Verbindungen über das Web	—	TCP → ASN.1/JSON	—	7224
ProCall	Verschlüsselte Schnittstelle zum Server für Verbindungen über das Web	—	TCP → TLS (1.2, 1.3) → estos ASN.1/JSON	Browser TLS Client (Chromium / Firefox / Safari)\	7225
UCConnect	Primary STUN/TURN UDP listener	—	UDP	—	3478
UCConnect	Primary STUN/TURN TCP listener (UDP fallback)	—	TCP	—	3478
UCConnect	UCConnect cloud controller for ProCall WebApp session routing and discovery	Production endpoint: uccontroller.ucconnect.de. TLS performed by browser network stack; effective cipher suite from browser intersect nginx edge (template ce140156).	TCP → TLS (1.2, 1.3) → REST	Browser TLS Client (Chromium / Firefox / Safari)\	443
UCConnect	UCConnect REST API for cloud authentication and service calls	Production endpoint: ucwebapi.ucconnect.de.	TCP → TLS (1.2, 1.3) → REST	Browser TLS Client (Chromium / Firefox / Safari)\	443
UCConnect	UCConnect cloud UCWeb WebSocket bridge	Production endpoint pattern: ucweb-ucweb[N]-0.ucconnect.de. Browser WebSocket over TLS to nginx :443.	TCP → TLS (1.2, 1.3) → WebSocket	Browser TLS Client (Chromium / Firefox / Safari)\	443
UCConnect	TURN credential provisioning for WebRTC in browser	Production endpoint: ucturnapi.ucconnect.de.	TCP → TLS (1.2, 1.3) → REST	Browser TLS Client (Chromium / Firefox / Safari)\	443
UCConnect	UCConnect portal for cloud login and administration	Production endpoint: portal.ucconnect.de.	TCP → TLS (1.2, 1.3) → REST	Browser TLS Client (Chromium / Firefox / Safari)\	443
UCConnect	UCConnect push notification path (cloud)	Production endpoint: ucpush.ucconnect.de. WebApp does not call UCPush directly; documented for UCConnect cloud push path used by paired clients.	TCP → TLS (1.2, 1.3) → REST	Browser TLS Client (Chromium / Firefox / Safari)\	443
UCConnect	TURN over DTLS on coturn primary TLS port	Production: turn[N].ucconnect.de:5349/udp. Credentials from ucturnapi.ucconnect.de.	UDP → DTLS (1.2) → TURN/STUN	WebRTC DTLS Client (libwebrtc / BoringSSL)\	5349
UCConnect	TURNS on coturn primary TLS port	Production: turn[N].ucconnect.de:5349/tcp.	TCP → TLS (1.2, 1.3) → TURN/STUN	WebRTC TURNS TLS Client (libwebrtc / BoringSSL)\	5349
UCConnect	TURN media relay after session allocation	Production: turn[N].ucconnect.de ports 49152-65535/udp. Plain UDP relay traffic after DTLS/TURNS session established.	UDP → TURN relay	—	49152-65535
UCConnect	TURN over DTLS on coturn alt TLS port 443	Production: turn[N].ucconnect.de:443/udp.	UDP → DTLS (1.2) → TURN/STUN	WebRTC DTLS Client (libwebrtc / BoringSSL)\	443
UCConnect	TURNS on coturn alt TLS port 443	Production: turn[N].ucconnect.de:443/tcp.	TCP → TLS (1.2, 1.3) → TURN/STUN	WebRTC TURNS TLS Client (libwebrtc / BoringSSL)\	443

ProCall Mobile Apps (iOS/Android)

ProCall Mobile Apps für Smartphones und Tablets mit Betriebssystem iOS oder Android

Mobile Apps (iOS/Android)

ProCall als mobile App für Smartphones und Tablets mit Betriebssystem iOS oder Android

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
WebRTC Media von und zu Clients/Media Server (Audio/Video, Softphone) (1024-65535, in/out)	—	UDP	—	1024

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	Schnittstelle zum Server für Verbindungen über das Web	—	TCP → ASN.1/JSON	—	7224
ProCall	Verschlüsselte Schnittstelle zum Server für Verbindungen über das Web	—	TCP → TLS (1.2, 1.3) → estos ASN.1/JSON	NodeJS 24.13.1 / OpenSSL 3.5.5	7225
UCConnect	Primary STUN/TURN UDP listener	—	UDP	—	3478
UCConnect	Primary STUN/TURN TCP listener (UDP fallback)	—	TCP	—	3478
UCConnect	UCConnect push notification registration endpoint	Production endpoint: ucpush.ucconnect.de. UCServer registers mobile devices; mobile apps receive push via platform providers.	TCP → TLS (1.2, 1.3) → REST	nginx 1.29.5-alpine / OpenSSL 3.5+	443
UCConnect	UCConnect cloud UCWeb WebSocket bridge for mobile clients	Production endpoint pattern: ucweb-ucweb[N]-0.ucconnect.de.	TCP → TLS (1.2, 1.3) → WebSocket	nginx 1.29.5-alpine / OpenSSL 3.5+	443
UCConnect	UCConnect cloud controller for mobile app registration	—	TCP → TLS (1.2, 1.3) → REST	nginx 1.29.5-alpine / OpenSSL 3.5+	443
UCConnect	Mobile device configuration and App Links assets	Production endpoint: mobileconfig.ucconnect.de.	TCP → TLS (1.2, 1.3) → HTTP	nginx 1.29.5-alpine / OpenSSL 3.5+	443
UCConnect	TURN credential provisioning for mobile WebRTC	Production endpoint: ucturnapi.ucconnect.de.	TCP → TLS (1.2, 1.3) → REST	nginx 1.29.5-alpine / OpenSSL 3.5+	443
UCConnect	TURN over DTLS on coturn primary TLS port	Production: turn[N].ucconnect.de:5349/udp.	UDP → DTLS (1.2) → TURN/STUN	WebRTC DTLS Client (libwebrtc / BoringSSL)\	5349
UCConnect	TURNS on coturn primary TLS port	Production: turn[N].ucconnect.de:5349/tcp.	TCP → TLS (1.2, 1.3) → TURN/STUN	WebRTC TURNS TLS Client (libwebrtc / BoringSSL)\	5349
UCConnect	TURN media relay after session allocation	Production: turn[N].ucconnect.de ports 49152-65535/udp.	UDP → TURN relay	—	49152-65535
UCConnect	TURN over DTLS on coturn alt TLS port 443	Production: turn[N].ucconnect.de:443/udp.	UDP → DTLS (1.2) → TURN/STUN	WebRTC DTLS Client (libwebrtc / BoringSSL)\	443
UCConnect	TURNS on coturn alt TLS port 443	Production: turn[N].ucconnect.de:443/tcp.	TCP → TLS (1.2, 1.3) → TURN/STUN	WebRTC TURNS TLS Client (libwebrtc / BoringSSL)\	443

ECSTA

Portfreigaben für ECSTA und uaCSTA Server.

ECSTA / uaCSTA

Portfreigaben für ECSTA und uaCSTA Server.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ECSTA	Verbindung vom ECSTA zu uaCSTA	—	TCP → SIP	—	5080
ECSTA	Verbindung vom ECSTA uaCSTA	—	TCP → TLS (1.0, 1.1, 1.2) → SIP	estos Crypto SSPI Client\	5081
estos Lizenzserver	Verbindung zum estos Lizenzserver licenseserver.estos.de zur Lizenzbindung von ECSTA-Lizenzen	—	TCP	—	443

uaCSTA Server Admin

Portfreigaben für ECSTA und uaCSTA Server.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ECSTA	Verbindung vom uaCSTA Server Admin (nur localhost)	—	TCP → SIP	—	5090

uaCSTA Server

Standalone uaCSTA-Server-Produkt (Ports 5080-5090, 5060/5061). Nicht im ProCall-Repo implementiert — separater uaCSTA/ECSTA-Produktbaum. Im ProCall-Repo existiert nur die ECSTA-Proxy-Integration (etapisrv/etapi32/ecstaproxy/).

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Verbindung vom ECSTA zu uaCSTA	—	TCP → SIP	—	5080
Verbindung vom ECSTA uaCSTA	—	TCP → TLS (1.0, 1.1, 1.2) → SIP	estos Crypto SSPI Server\	5081
Verbindung vom uaCSTA Server Admin (nur localhost)	—	TCP → SIP	—	5090
Verbindung von Telefonen	—	TCP → SIP	—	5060
Verbindung von Telefonen	—	TCP → TLS (1.0, 1.1, 1.2) → SIP	estos Crypto SSPI Server\	5061

Mitel MiVoice MX-ONE CSTA3 XML

estos ECSTA für Mitel MX-ONE CSTA3 XML mit Mitel OEM

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
SIP PBX	estos ECSTA for Mitel MiVoice MX-ONE stellt mehrere Telephony Service Provider für Microsoft® TAPI 2.1 (auch 2.2 und 3.0) zur Verfügung. Diese TAPI-Treiber stellen eine zentrale Kommunikation zwischen einem PC und der Telefonanlage her. Auf diesem Server stehen alle Geräte der Telefonanlage als TAPI-Leitungen zur Verfügung. Alle estos ECSTA for Mitel MiVoice MX-ONE Treiber verwenden die leistungsfähige CSTA Schnittstelle um mit der Telefonanlage zu kommunizieren.	—	TCP → CSTA Phase3 XML	—	8882

ECSTA for OpenScape 4000

estos ECSTA for OpenScape 4000 stellt mehrere Telephony Service Provider für Microsoft® TAPI 2.1 (auch 2.2 und 3.0) zur Verfügung. Diese TAPI-Treiber stellen eine zentrale Kommunikation zwischen einem PC und der Telefonanlage her. Auf diesem Server stehen alle Geräte der Telefonanlage als TAPI-Leitungen zur Verfügung.

Alle estos ECSTA for OpenScape 4000 Treiber verwenden die leistungsfähige CSTA Schnittstelle um mit der Telefonanlage zu kommunizieren.

https:\/\/help.estos.com/help/de-DE/ecsta/6.0/ecstaH4K/dokumentation/index.htm

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
SIP PBX	CSTA Interface	—	TCP → CSTA Phase 3 ASN1/BER	—	1040

MetaDirectory

MetaDirectory is a Windows server product centered on the MetaServer.exe service (emeta). It provides configurable LDAP/LDAPS, HTTP/HTTPS, administration, and discovery interfaces, plus installed administration and replication helper processes.

MetaDirectory

MetaDirectory führt unterschiedliche Datenbanken zu einem einzigen, unternehmensweit einsetzbaren, konsistenten LDAP-Verzeichnis zusammen. Die intelligente Aufbereitung der Daten ermöglicht einfache Suche und schnelle Präsentation der Resultate - auch bei sehr großen und verteilten Datenbeständen.
Installierte MetaDirectory-Laufzeitumgebung auf einem Windows-Host, einschließlich Dienst MetaServer.exe, Administrationsoberfläche MetaAdmin.exe und Scheduling der Replikation (Synchronisierung der Daten)

Core

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
MetaDirectory administration interface	Default TCP port 7302; listener ports and bind addresses are configurable. Code supports optional/mandatory STARTTLS on this admin interface; if configured admin listeners fail, MetaServer opens a localhost fallback on 127.0.0.1:7302.	TCP → MetaDirectory Admin binary protocol	—	7302
MetaDirectory LDAP server interface	Default TCP port 712; listener ports and bind addresses are configurable. LDAP supports the STARTTLS extended operation when configured by the listener protocol.	TCP → LDAP	—	712
MetaDirectory LDAPS server interface	Default TCP/TLS port 714; listener ports and bind addresses are configurable. TLS is provided by Windows Schannel via SSPI; TLS 1.3 depends on operating-system support.	TCP → TLS (1.0, 1.1, 1.2) → LDAPS	estos Crypto SSPI Server\	714
MetaDirectory HTTP web interface	Default TCP port 80; listener ports and bind addresses are configurable.	TCP → HTTP	—	80
MetaDirectory HTTPS web interface	Default TCP/TLS port 443; listener ports and bind addresses are configurable.	TCP → TLS (1.1, 1.2, 1.0, 1.3) → HTTP	Windows SSPI Server\	443
MetaDirectory server discovery broadcast receiver	—	UDP	—	7300

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
UCConnect	Conditional UCConnect/UCController connection for online licensing and UCConnect LDAP tunnel workflows. MetaServer initiates this only when not offline-licensed, OEM/configuration permits UCConnect, and UCConnect settings are complete.	Der Laufzeit-Endpunkt wird aus der UCConnect-Konfiguration und dem Umleitungsablauf des Controllers abgeleitet.	TCP → TLS (1.2, 1.3) → REST	estos Crypto SSPI Client\	443
Active Directory	Conditional Active Directory LDAPS connection for User Manager / authentication workflows when an AD host is configured with TLS enabled.	AD host, port, and TLS selection are runtime configuration. Code uses LDAP_SSL_PORT (636) for TLS-enabled AD authentication and user-manager connections.	TCP → TLS (1.0, 1.1, 1.2) → LDAPS	estos Crypto SSPI Client\	636
Active Directory	Conditional Active Directory LDAP connection for User Manager / authentication workflows when an AD host is configured without TLS, or when NTLM/GSS-SPNEGO AD relay deliberately uses cleartext LDAP even if the main AD setting uses LDAPS.	AD host and port are runtime configuration. Code forces the AD relay path from LDAP_SSL_PORT to LDAP_PORT (389) so the domain controller receives a valid cleartext LDAP bind exchange.	TCP	—	389

MetaAdmin.exe

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
MetaDirectory	Administration UI connection to MetaServer.exe admin interface (default TCP 7302; configurable).	—	TCP → MetaDirectory Admin binary protocol	—	7302

Replicator process family

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
MetaDirectory	Replicator jobs connect back to MetaServer LDAP when synchronizing through the local/default MetaDirectory interface.	—	TCP → LDAP	—	712
MetaDirectory	Replicator jobs can use MetaServer LDAPS when the selected MetaDirectory listener is TLS-enabled.	—	TCP → TLS (1.0, 1.1, 1.2) → LDAPS	SSPI (Security Support Provider Interface) / Schannel	714

ProCall Analytics

Statistik-, Reporting- und Web-Server-Cluster für ProCall Analytics. .NET-Services unter estosnet/StatisticServices/, native Admin unter estos/Analytics/Admin/. Standard-Ports: Statistik WCF 8735-8989 (Default 8736), Web 8732-8999.

ProCall Analytics Statistik Server

Zuständig für die Verarbeitung von Aufträgen.
Verwendet Daten aus Datenbanken, aggregiert diese, erstellt und versendet Reports und übernimmt die Benutzerauthentifizierung.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Interface provided by WCF a XMLA for ProCall Analytics WebServer	—	TCP → SOAP / XMLA	—	8735-8989

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall	Client connection interface Used by ProCall Client, Update Service, SDK	Used to fetch users, groups, licenses and user-rights.	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	Analytics Client\	7222
SMTP Server	SMTPS (implicit TLS)	—	TCP → TLS (1.2, 1.3) → SMTP	estos Crypto SSPI Client\	465
Microsoft SQL Server	SQL Server ODBC (TLS)	—	TCP → TLS (1.2, 1.3) → ODBC	estos Crypto SSPI Client\	1433

ProCall Analytics Reporting Server

Holt Daten aus dem ProCall Analytics Statistik Server.
Erstellt Reports und exportiert diese als PDF.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall Analytics	Holt Statistikdaten vom Analytics Statistik Server (WCF/XMLA)	—	TCP → SOAP / XMLA	estos Crypto SSPI Client\	8735-8989

ProCall Analytics Web Server

Dieser Webserver stellt den Clients Statistikdaten aus dem ProCall Analytics Statistik Server zur Verfügung, triggert und queued Reports für den ProCall Analytics Reporting Server.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Der Zugriff via Webclient	Extern relevant ist praktisch Port — oft 8732 nach Installation, konfigurierbar in der Admin-UI. der Scan-Bereich für die Erstvergabe ist 8732–8999.	TCP → TLS → REST	Analytics WebServer\	8732-8999

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall Analytics	Interface provided by WCF a XMLA for ProCall Analytics WebServer	—	TCP → SOAP / XMLA	estos Crypto SSPI Client\	8735-8989

ProCall Analytics Admin

Responsible for the configuration of ProCall Analytics.
WebServer ports, System Status, ...

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall Analytics	Konfiguration und Status des Analytics Statistik Servers	—	TCP → SOAP / XMLA	estos Crypto SSPI Client\	8735-8989
ProCall	UCServer-Admin-Verbindung für Benutzer, Gruppen und Lizenzen	—	TCP → TLS (1.0, 1.1, 1.2) → estos ROSE ASN1/BER	Analytics Client\	7222

ProCall Analytics PhantomJS/Headless browser

Emuliert eine Benutzersitzung, um zeitabhängige Reports zu erstellen. Wird vom ProCall Analytics Webserver aufgerufen und prüft den Hash dieser Anwendung.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall Analytics	Der Zugriff via Webclient	—	TCP → TLS → REST	estos Crypto SSPI Client\	8732-8999

ProCall Analytics Client Dashboard

Dashboard, das direkt in einem Browser verwendet oder im ProCall Client als CustomTab eingebettet werden kann.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall Analytics	Der Zugriff via Webclient	—	TCP → TLS → REST	Browser TLS Client (Chromium / Firefox / Safari)\	8732-8999

UCConnect

Cloud-Plattform für UCServer tenancy: Portal, API, Routing, UCWeb Gateways, TURN und Mobile Push

UCConnect Portal (portal.ucconnect.de)

Angular web portal (ucc_portal) for customer/admin self-service; static assets behind nginx on UCCore.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Public HTTPS portal at portal.ucconnect.de; nginx terminates TLS and proxies API paths to ucapi.	Production endpoint: portal.ucconnect.de. TLS terminated by nginx on UCCore VM (uccore.yml, nginx_template_ucportal.conf). Static portal assets served from ucportal container volume; API paths proxied to ucapi:3000. TLS L4/L5 from listening template ce140156-47c9-4a92-bc73-fb388facb6b1 (nginx_ssl.conf.j2).	TCP → TLS (1.2, 1.3) → REST	nginx 1.29.5-alpine Edge TLS\	443

UCConnect API (ucwebapi.ucconnect.de)

REST-API für Kunden, Abonnements, UCServer, Authentifizierung, UCaaS und Connect-Integrationen.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Öffentliche HTTPS-API unter ucwebapi.ucconnect.de. Stellt Telemetrie-JWTs über /api/ucsauth/openid-connect/token aus.	—	TCP → TLS (1.2, 1.3) → REST	nginx 1.29.5-alpine Edge TLS\	443

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
MongoDB	UCConnect API persistence via mongoose (MONGO_URL)	—	TCP → MongoDB wire protocol	NodeJS 24.13.1 Windows OnPremise Client\	27017
Redis 8	Cache and session state via ioredis (UCCONNECT_REDIS_*)	—	TCP → TLS (1.2, 1.3) → RESP	NodeJS 24.13.1 Windows OnPremise Client\	6379
SMTP Server	Outbound transactional email (SMTP submission, port 587)	—	TCP → TLS (1.2, 1.3) → SMTP	NodeJS 24.13.1 Windows OnPremise Client\	587
estos Lizenzserver	License binding and validation (LICENSESERVER_URL)	—	TCP	NodeJS 24.13.1 Windows OnPremise Client\	443
Infisical (secrets.uccloud.de)	UCaaS secret retrieval via Infisical SDK (INFISICAL_*)	—	TCP → TLS (1.2, 1.3) → REST	NodeJS 24.13.1 Windows OnPremise Client\	443
STARFACE Skynet	UCaaS PBX VM lifecycle via Skynet API (SKYNET_URL)	—	TCP → TLS (1.2, 1.3) → REST	NodeJS 24.13.1 Windows OnPremise Client\	443
estos Telemetry Collector	OpenTelemetry OTLP export (TELEMETRY_ENDPOINT)	—	TCP → TLS (1.2, 1.3) → REST	NodeJS 24.13.1 Windows OnPremise Client\	443

UCConnect UCController (uccontroller.ucconnect.de)

Routes ProCall clients to UCWeb tenants; serves meta DNS and WebSocket load balancing.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Public HTTPS/WebSocket entry at uccontroller.ucconnect.de; nginx → uccontroller:8224 with selective ucapi/license proxies.	Production endpoint: uccontroller.ucconnect.de. TLS terminated by nginx on UCCore VM (uccore.yml, nginx_template_uccontroller.conf). Default traffic proxied to uccontroller:8224; /api/connect/* proxied to ucapi:3000; /licenseservice/* proxied to licenseserver.estos.de. TLS L4/L5 from listening template ce140156-47c9-4a92-bc73-fb388facb6b1 (nginx_ssl.conf.j2).	TCP → TLS (1.2, 1.3) → REST	nginx 1.29.5-alpine Edge TLS\	443
DNS server for meta.ucconnect.de NS delegation	uccontroller container on UCCore VM listens on 53/udp (uccore.yml docker compose: 53:53/udp). Serves DNS for the meta subdomain; Route53 NS record {dns_env_prefix}meta.ucconnect.de delegates to {dns_env_prefix}uccore.ucconnect.de. Firewall: ufw allows 53/udp on UCCore.	UDP → DNS	—	53

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
Redis 8	UCWeb routing state via Redis (UCCONNECT_REDIS_*)	—	TCP → TLS (1.2, 1.3) → RESP	NodeJS 24.13.1 Windows OnPremise Client\	6379
estos Telemetry Collector	OpenTelemetry OTLP export (UCCONNECT_TELEMETRY_ENDPOINT)	—	TCP → TLS (1.2, 1.3) → REST	NodeJS 24.13.1 Windows OnPremise Client\	443

UCWeb UCConnect (ucweb-ucweb[N]-[M].ucconnect.de)

Multi-tenant UCServer gateway (ucc_web, UCConnect mode): WebSocket sessions, per-tenant meta, MetaDirectory LDAP.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Instance HTTPS/WebSocket front door (ucweb-ucweb[N]-[M].ucconnect.de); nginx → ucweb:7224.	Production endpoint pattern: ucweb-ucweb[N]-0.ucconnect.de (e.g. ucweb-ucweb1-0.ucconnect.de). TLS terminated by nginx on UCWeb VM (ucweb.yml, nginx_template_ucweb.conf.j2). WebSocket paths proxied to ucweb:7224; static files at /. TLS L4/L5 from listening template ce140156-47c9-4a92-bc73-fb388facb6b1 (nginx_ssl.conf.j2).	TCP → TLS (1.2, 1.3) → WebSocket	nginx 1.29.5-alpine Edge TLS\	443
Per-tenant meta endpoint with TLS terminated by ucweb	Production endpoint pattern: .{tenant}.meta.ucconnect.de under wildcard .meta.ucconnect.de (production: meta.ucconnect.de zone). TLS terminated directly by ucweb process using META_TLS_CERT_PATH / META_TLS_KEY_PATH (wildcard LE cert from manage_ssl_certificates in ucweb.yml). Not proxied through nginx; nginx uses plain http:\/\/ucweb:7224 for instance vhost only.	TCP → TLS (1.2, 1.3) → WebSocket	estos/ucweb (Node.js / OpenSSL bundled)	7224
LDAP over TLS for MetaDirectory (UCServer directory lookups)	MetaDirectory LDAPServer listens on 714/tcp with TLS; SNI required (hostname pattern {ucsid}.meta.ucconnect.de). Certificates loaded from META_TLS_CERT_PATH / META_TLS_KEY_PATH (wildcard *.meta.ucconnect.de). Published 714:714 on UCWeb VM (ucweb.yml docker compose). UCConnect mode only (MetaDirectory.shallload).	TCP → TLS (1.2, 1.3) → LDAP	estos/ucweb (Node.js tls.createServer / OpenSSL bundled)	714

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
Sentry	Client error reporting URL advertised to UCServer clients (clienterrorreporting capability)	—	TCP → TLS (1.2, 1.3) → HTTPS	Browser TLS Client (Chromium / Firefox / Safari)\	443
Redis 8	Session/cache state via Redis (UCWEB_REDIS_*) in UCConnect mode	—	TCP → TLS (1.2, 1.3) → RESP	NodeJS 24.13.1 Windows OnPremise Client\	6379
estos Telemetry Collector	OpenTelemetry metrics/traces export (TELEMETRY_ENDPOINT / TELEMETRY_TRACING_ENDPOINT)	Production: TELEMETRY_ENDPOINT=https:\/\/collector-grpc.uccloud.de/v1/metrics.	TCP → TLS (1.2, 1.3) → REST	NodeJS 24.13.1 Windows OnPremise Client\	443
UCConnect	Telemetry JWT via TELEMETRY_AUTH_ENDPOINT (/api/ucsauth/openid-connect/token)	Production: TELEMETRY_AUTH_ENDPOINT=https:\/\/ucwebapi.ucconnect.de/api/ucsauth/openid-connect/token. UCConnect apikey passed as TELEMETRY auth (Settings.ts).	TCP → TLS (1.2, 1.3) → REST	NodeJS 24.13.1 Windows OnPremise Client\	443

Turn/Stun Server (turn[N].ucconnect.de)

coturn TURN/STUN relay farm (turn[N].ucconnect.de) for UCConnect WebRTC media traversal.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Primary STUN/TURN UDP listener	—	UDP	—	3478
Primary STUN/TURN TCP listener (UDP fallback)	—	TCP	—	3478
TURN over DTLS alternative listener on port 443	alt-tls-listening-port=443 UDP/DTLS in turnserver.conf. Fallback when 5349 UDP blocked.	UDP → DTLS (1.2) → TURN/STUN	coturn 4.6.3 DTLS\	443
TURNS (TLS) alternative listener on port 443	alt-tls-listening-port=443 in turnserver.conf. Fallback TURNS when 5349 blocked. Production: turn[N].ucconnect.de.	TCP → TLS (1.2, 1.3) → TURN/STUN	coturn 4.6.3 TURNS\	443
TURNS (TLS) on primary TLS port	tls-listening-port=5349 in turnserver.conf. coturn/coturn:4.6.3 host network mode on UCTurn VM (ucturn.yml).	TCP → TLS (1.2, 1.3) → TURN/STUN	coturn 4.6.3 TURNS\	5349
TURN media relay port range	min-port=49152, max-port=65535 in turnserver.conf. ufw allows 49152:65535/tcp and udp on UCTurn VM.	UDP → TURN relay	—	49152-65535
Alternative STUN/TURN listener UDP (RFC 5780 symmetry)	alt-listening-port=80 UDP in turnserver.conf.	UDP → TURN/STUN	—	80
Prometheus metrics endpoint	prometheus-port=9641 in turnserver.conf; path /metrics. Firewall allows 9641/tcp.	TCP → HTTP	—	9641
TURN over DTLS on primary TLS port	tls-listening-port=5349 UDP/DTLS in turnserver.conf. coturn host network on UCTurn VM.	UDP → DTLS (1.2) → TURN/STUN	coturn 4.6.3 DTLS\	5349
Alternative STUN/TURN listener (RFC 5780 symmetry)	alt-listening-port=80 in turnserver.conf. Firewall allows 80/tcp and 80/udp on UCTurn VM.	TCP → TURN/STUN	—	80

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
Redis 8	coturn user/statistics database via redis-userdb (hiredis)	—	TCP → TLS (1.2, 1.3) → RESP	—	6379

UCPush (ucpush.ucconnect.de)

Inbound REST push notification service for UCConnect mobile clients. TLS terminated by nginx on UCPush VM (ucpush.yml); /push/ proxied to ucpush:3006. UCServer and cloud services POST push jobs to this endpoint.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Inbound REST API receiving push notification jobs from UCServer and UCConnect services. TLS at nginx :443; backend ucpush:3006. Routes: /push/api/, /push/healthcheck/, /push/dnshealth.	Production endpoint: ucpush.ucconnect.de (service alias) and ucpush-ucpush[N]-0.ucconnect.de (instance). TLS terminated by nginx on UCPush VM (ucpush.yml, nginx_template.conf). /push/ proxied to ucpush:3006. TLS L4/L5 from listening template ce140156-47c9-4a92-bc73-fb388facb6b1 (nginx_ssl.conf.j2).	TCP → TLS (1.2, 1.3) → REST	nginx 1.29.5-alpine Edge TLS\	443

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
Google API	Push delivery via Firebase Cloud Messaging (firebase-admin)	—	TCP → TLS (1.2, 1.3) → REST	NodeJS 24.13.1 Windows OnPremise Client\	443
Redis 8	Push channel state via Redis (UCPUSH_REDIS_*)	—	TCP → TLS (1.2, 1.3) → RESP	NodeJS 24.13.1 Windows OnPremise Client\	6379
Apple Push Notification service (APNs)	Push delivery via Apple APNs (firebase-admin)	—	TCP → TLS (1.2, 1.3) → REST	NodeJS 24.13.1 Windows OnPremise Client\	443
Grafana Loki	Application log push (UCPUSH_LOKI_API_URL)	—	TCP → TLS (1.2, 1.3) → REST	NodeJS 24.13.1 Windows OnPremise Client\	3200

UCConnect UCTurnAPI (ucturnapi.ucconnect.de)

TURN credential REST API (ucc_turn, :3005) issuing short-lived relay credentials to clients.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Public HTTPS API at ucturnapi.ucconnect.de; nginx → ucturnapi:3005 (/turn/rest/getturn, etc.).	Production endpoint: ucturnapi.ucconnect.de (service alias) and ucturnapi-uccore[N]-0.ucconnect.de (instance on UCCore VM). TLS terminated by nginx on UCCore VM (uccore.yml, nginx_template_ucturnapi.conf). All requests proxied to ucturnapi:3005. TLS L4/L5 from listening template ce140156-47c9-4a92-bc73-fb388facb6b1 (nginx_ssl.conf.j2).	TCP → TLS (1.2, 1.3) → REST	nginx 1.29.5-alpine Edge TLS\	443

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
Redis 8	TURN credential and session state via Redis (ucconnect.redis, db 2 typical)	—	TCP → TLS (1.2, 1.3) → RESP	NodeJS 24.13.1 Windows OnPremise Client\	6379

UCConnect Mobileconfig (mobileconfig.ucconnect.de)

Serves mobile device configuration profiles and Android App Links verification for UCConnect mobile clients

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Mobile device configuration and App Links endpoint	Production endpoint: mobileconfig.ucconnect.de. TLS terminated by nginx on UCCore VM (uccore.yml, nginx_template_mobileconfig.conf). Static files from /home/ubuntu/mobileconfig mounted into nginx. TLS L4/L5 from listening template ce140156-47c9-4a92-bc73-fb388facb6b1 (nginx_ssl.conf.j2).	TCP → TLS (1.2, 1.3) → HTTP	nginx 1.29.5-alpine Edge TLS\	443

ProCall Meetings

Online-Dienst. Wildcard *.meetings.procall.de empfohlen.

ProCall Meetings Webclient

Client-Anforderungen für ProCall Meetings und UCServer-Integration.

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
ProCall Meetings	HTTPS API und WebSocket (Signaling) via nginx auf ECS, erreichbar über HAProxy lb.*meetings.procall.de:443	—	TCP → TLS (1.2, 1.3) → REST → WebSocket	Browser TLS Client (Chromium / Firefox / Safari)\	443
ProCall Meetings	WebRTC-Media (RTP) direkt zum Janus SFU auf ECS	—	UDP → DTLS → SRTP	BoringSSL (Janus --enable-boringssl)	20000-40000
ProCall Meetings	STUN auf coturn (turn-.meetings.procall.de), UDP alt-port 443	—	UDP	—	443
ProCall Meetings	Plain TURN Media Relay (UDP) auf coturn alt-port 443	—	UDP	—	443
ProCall Meetings	Plain TURN Media Relay (TCP) auf coturn alt-port 443	—	TCP	—	443
ProCall Meetings	TURNS (TLS/DTLS) Media Relay auf coturn	—	TCP → TLS (1.0, 1.1, 1.2) → TURN/STUN	Browser TLS Client (Chromium / Firefox / Safari)\	443
UCConnect	UCConnect cloud controller for ProCall Meetings integration	Production endpoint: uccontroller.ucconnect.de.	TCP → TLS (1.2, 1.3) → REST	Browser TLS Client (Chromium / Firefox / Safari)\	443

ProCall Meetings Service

Backend-Online-Dienst für ProCall Meetings. Deployment via econf_infrastructure (Ansible): ECS-Knoten (nginx + econf-server + Janus), HAProxy-Loadbalancer (lb.*meetings.procall.de), separate TURN-Knoten (turn-*.*meetings.procall.de). Wildcard *.meetings.procall.de empfohlen. Source of truth: econf_infrastructure playbooks (bootstrap_ecs.yml, bootstrap_loadbalancer.yml, bootstrap_turn.yml).

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
HTTPS API und WebSocket (Signaling) via nginx auf ECS, erreichbar über HAProxy lb.*meetings.procall.de:443	HAProxy TCP passthrough. nginx:1.21.6, TLS 1.2/1.3, Let's Encrypt. Paths: /conf/rest, /conf/ws, /observer/ws, /version, /healthcheck. Source: playbooks/files/nginx_template.conf.j2, playbooks/files/haproxy.cfg.j2	TCP → TLS (1.2, 1.3) → REST → WebSocket	nginx 1.21.6 / OpenSSL (system)	443
WebRTC-Media (RTP) direkt zum Janus SFU auf ECS	Image meetprocall.azurecr.io/estos/econf-janus. DTLS self-signed (no nginx LE cert). Source: playbooks/files/janus.jcfg.j2, econf-server/docker/janus/Dockerfile	UDP → DTLS → SRTP	BoringSSL (Janus --enable-boringssl)	20000-40000
STUN auf coturn (turn-.meetings.procall.de), UDP alt-port 443	Plain STUN. Fallback: stun:stun.meetings.procall.de:19302. coturn also on 3478/80. Host: separate TURN server, not ECS. Source: coturn_config.conf.j2, bootstrap_ecs.yml	UDP	—	443
Plain TURN Media Relay (UDP) auf coturn alt-port 443	No TLS/DTLS on L5. Relayed payload typically SRTP (browser). Auth: use-auth-secret. Host: turn-* Server.	UDP	—	443
Plain TURN Media Relay (TCP) auf coturn alt-port 443	No TLS on L5. Not TURNS. Host: turn-* Server.	TCP	—	443
TURNS (TLS/DTLS) Media Relay auf coturn	coturn 4.5.1.1 (Ubuntu 20.04 apt). tls-listening-port=5349, alt-tls-listening-port=443. LE certs to /home/turnserver/certs/. DH 2048-bit. Host: turn-* Server. Source: bootstrap_turn.yml, coturn_config.conf.j2	TCP → TLS (1.0, 1.1, 1.2) → TURN/STUN	coturn 4.5.1.1 / OpenSSL 1.1.1 (system)	443

estos Lizenzserver

Lizenz-Server hosted on licenseserver.estos.de

estos Lizenzserver (licenseserver.estos.de)

Zielsysteme für ausgehende Verbindungen (Richtung out). Wildcards *.ucconnect.de und *.meetings.procall.de empfohlen.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Verbindung zum estos Lizenzserver licenseserver.estos.de zur Lizenzbindung von ECSTA-Lizenzen	—	TCP	—	443

ixi-UMS 8

Unified Messaging Server Software
für Versand und Empfang von Fax-Nachrichten, SMS und Voice-Nachrichten
mit Integration in z.B. Microsoft Exchange Server oder HCL Domino

ixi-UMS 8 Kernel

Der Kernel von ixi-UMS ist die eigentliche Server-Software und bildet die Schnittstelle zwischen Computer und Telefonnetz.

Kernel

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
SIP PBX	SRTP Audio Stream	—	UDP → SRTP → SRTP	XCAPI SRTP Client\	1025-65535
SIP PBX	SIP Registrar und Trunk TLS	—	TCP → TLS (1.2, 1.3) → SIP	XCAPI SRTP Client\	5061
SIP PBX	SIP Registrar und Trunk UDP (ohne Verschlüsselung) Trunk nicht in Infinity verfügbar	—	UDP	—	5060
SIP PBX	SIP Registrar und Trunk TCP	—	TCP	—	5060

ixi-UMS Mail Server Connector

Der ixi-UMS Mail Server Connector ist ein Zusatzmodul zum ixi-UMS Kernel, das die Verbindung zu einem Mailserver herstellt. Der Connector ist dabei zuständig für die Zustellung von ankommenden UMS-Nachrichten Fax, SMS, Voice (vom ixi-UMS Kernel zum Mailserver) sowie die Verarbeitung von ausgehenden UMS-Nachrichten (vom Mailserver zum ixi-UMS Kernel).
Der ixi-UMS Mail Server Connector hat damit primär die Aufgaben: Kommunikation mit dem Mailsystem per SMTP, Überprüfung der Benutzer und Zuordnung der Empfängernummer per LDAP-Abfrage.

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
Mail-Server Schnittstelle für Mail-Clients	—	TCP → SMTP	—	25
Verschlüsselte Mail-Server Schnittstelle für Mail-Clients	—	TCP → TLS (1.1, 1.2, 1.0, 1.3) → SMTP	Windows SSPI Server\	465

Connects to

Target	Interface description (why this component connects)	Note (consumer-specific remote caveats)	Protocol stack	Cryptographic details (client template; see appendix)	Port
SMTP Server	SMTP relay	—	TCP → SMTP	—	25
SMTP Server	SMTPS (implicit TLS)	—	TCP → TLS (1.2, 1.3) → SMTP	Windows SSPI Client\	465
Active Directory	LDAP (ohne TLS)	—	TCP	—	389
Active Directory	LDAPS (TLS)	—	TCP → TLS (1.0, 1.1, 1.2) → LDAPS	Windows SSPI Client\	636

ixi-UMS MDS Message Distribution Server

Der ixi-UMS Message Distribution Server (ixi-UMS MDS) hat die Aufgabe, ixi-UMS Nachrichten anhand der Empfängernummer an den dafür konfigurierten Standort weiterzugeben.

No interfaces.

ixi-UMS Voice-Mail Server

Der ixi-UMS Voice-Mail Server ist im Wesentlichen ein Voice Mailbox System mit Fernabfrage.
ueber IMAP/IMAP S OpenSSl 1.0.2

No interfaces.

ixi-UMS FAPI Connector (File API Connector)

ixi-UMS Enterprise stellt seine Unified Messaging Funktionalität mit Fax, Voice und SMS für verschiedenste Umgebungen zur
Verfügung. Für die Integration in Fremdsysteme bietet ixi-UMS Enterprise unter anderem den ixi-UMS FAPI Connector an.

No interfaces.

ixi-UMS Auto Attendant

Über ixi-UMS Auto Attendant steht ein IVR-System bzw. eine automatische Telefonvermittlung zur Verfügung, das Anrufer begrüßt und dann weitere Optionen zur Verfügung stellt wie zum Beispiel weiterverbunden zu werden zu einer bestimmten Abteilung.

No interfaces.

ixi-UMS Portal

Weboberfläche für Benutzer Konfigurator: Über den ixi-UMS Portal Server steht das ixi-UMS Benutzer Portal mit Webapplikationen für ixi-UMS Enterprise zur Verfügung.

No interfaces.

ixi-Framework 8

ixi-Framework stellt Software-Komponenten bereit, die für Funktion und Konfiguration der ixi-UMS Enterprise Software benötigt werden.

Apache 2.4 WebServer

Listens on

Interface description (purpose, who connects)	Note (auth, dual use, handshake caveats)	Protocol stack	Cryptographic details (template; see appendix)	Port
WebServer Schnittstelle zur Administration und Konfiguration der ixi-UMS Installation.	—	TCP → SOAP	—	8890

OpenLDAP

No interfaces.

Firebird DB

No interfaces.

Cryptographic templates

Listening interface templates

Analytics WebServer

Field	Value
Protocol stack	TCP → TLS
Cryptographic provider	—
Security note	Details müssen noch Documentiert werden

coturn 4.6.3 DTLS

Field	Value
Protocol stack	UDP → DTLS (1.2)
Cryptographic provider	coturn/coturn:4.6.3 (OpenSSL bundled)
Security note	Single RSA certificate (4096-bit) from Let's Encrypt at /etc/coturn/ssl/. DTLS on tls-listening-port 5349 and alt-tls-listening-port 443 UDP. Source: uccdeployment/files/turnserver.conf, ucturn.yml

coturn 4.6.3 TURNS

Field	Value
Protocol stack	TCP → TLS (1.2, 1.3)
Cryptographic provider	coturn/coturn:4.6.3 (OpenSSL bundled)
Security note	Single RSA certificate (4096-bit) from Let's Encrypt at /etc/coturn/ssl/; coturn supports only one cert/key pair (no dual ECDSA+RSA like nginx). tls-listening-port=5349; alt-tls-listening-port=443. Default OpenSSL cipher-list. Source: uccdeployment/files/turnserver.conf, ucturn.yml

estos Crypto SSPI Server

Field	Value
Protocol stack	TCP → TLS (1.0, 1.1, 1.2)
Cryptographic provider	SSPI (Security Support Provider Interface) / Schannel
Cipher suites	Windows Schannel cipher suites as configured by the operating system; Windows Server 2022: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022; Windows Server 2025: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2025; Windows 11 >= v22H2: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-11-v22h2
Security note	TLS 1.3 support is ongoing. Tracking ticket https:\/\/jira.estos.de/browse/ESPPP-1449

estos Kurento / GStreamer / OpenSSL 1.0.3-dev Server

Field	Value
Protocol stack	UDP → DTLS (SSLv3, 1.2)
Cryptographic provider	estos Kurento / GStreamer / OpenSSL 1.0.3-dev Server

estos Kurento / GStreamer / OpenSSL 1.0.3-dev Server SRTP

Field	Value
Protocol stack	UDP → SRTP
Cryptographic provider	estos Kurento / GStreamer / OpenSSL 1.0.3-dev Server SRTP

nginx 1.29.5-alpine Edge TLS

Field	Value
Protocol stack	TCP → TLS (1.2, 1.3)
Cryptographic provider	nginx 1.29.5-alpine / OpenSSL 3.5+
Cipher suites	TLS_AES_256_GCM_SHA384; TLS_AES_128_GCM_SHA256; TLS_AES_128_CCM_SHA256; ECDHE-ECDSA-AES256-GCM-SHA384; ECDHE-ECDSA-AES128-GCM-SHA256; ECDHE-RSA-AES256-GCM-SHA384; ECDHE-RSA-AES128-GCM-SHA256; ECDHE-ECDSA-AES256-SHA384; ECDHE-ECDSA-AES128-SHA256; ECDHE-RSA-AES256-SHA384; ECDHE-RSA-AES128-SHA256
Security note	Dual ECDSA+RSA certificate pairs per vhost. TLS 1.3 cipher suites: TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256, TLS_AES_128_CCM_SHA256. TLS 1.2 ciphers: ECDHE-ECDSA/RSA only (no plain RSA key exchange). PQC-hybrid key-exchange groups: SecP256r1MLKEM768, SecP384r1MLKEM1024, X25519MLKEM768 with classical fallback (X25519, secp256r1, secp384r1, secp521r1). ECDH curves: secp256r1, secp384r1, secp521r1, brainpoolP256r1. Server cipher preference on; session tickets off; HSTS max-age=31536000 includeSubDomains on all vhosts. Source of truth: uccdeployment/files/nginx_ssl.conf.j2 (intended production config; not yet re-scanned on live hosts).

NodeJS 24.13.1 Windows On-Premises

Field	Value
Protocol stack	TCP → TLS (1.2, 1.3)
Cryptographic provider	NodeJS 24.13.1 / OpenSSL 3.5.5
Cipher suites	Preferred TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Group X25519MLKEM768; Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Group X25519MLKEM768; Accepted TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Group X25519MLKEM768; Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253; Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve 25519 DHE 253; Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253; Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve 25519 DHE 253; Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve 25519 DHE 253; Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253; Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253; Accepted TLSv1.2 256 bits AES256-GCM-SHA384; Accepted TLSv1.2 128 bits AES128-GCM-SHA256; Accepted TLSv1.2 256 bits AES256-SHA256; Accepted TLSv1.2 128 bits AES128-SHA256; Accepted TLSv1.2 256 bits AES256-SHA; Accepted TLSv1.2 128 bits AES128-SHA
Security note	Following cli parameters are used to support deprecated certificates which are in used. --openssl-legacy-provider Details: https:\/\/docs.openssl.org/3.0/man7/OSSL_PROVIDER-legacy --tls-cipher-list=DEFAULT@SECLEVEL=1 Details: https:\/\/docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour Test result with sslscan.exe sslscan.exe https:\/\/localhost:7225 Version: 2.2.2 Windows 64-bit (Mingw) OpenSSL 3.5.4 30 Sep 2025 Connected to ::1 Testing SSL server localhost on port 7225 using SNI name localhost SSL/TLS Protocols: SSLv2 disabled SSLv3 disabled TLSv1.0 disabled TLSv1.1 disabled TLSv1.2 enabled TLSv1.3 enabled TLS Fallback SCSV: Server supports TLS Fallback SCSV TLS renegotiation: Session renegotiation not supported TLS Compression: Compression disabled Heartbleed: TLSv1.3 not vulnerable to heartbleed TLSv1.2 not vulnerable to heartbleed Supported Server Cipher(s): Preferred TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Group X25519MLKEM768 Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Group X25519MLKEM768 Accepted TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Group X25519MLKEM768 Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve 25519 DHE 253 Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve 25519 DHE 253 Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 Accepted TLSv1.2 256 bits AES256-GCM-SHA384 Accepted TLSv1.2 128 bits AES128-GCM-SHA256 Accepted TLSv1.2 256 bits AES256-SHA256 Accepted TLSv1.2 128 bits AES128-SHA256 Accepted TLSv1.2 256 bits AES256-SHA Accepted TLSv1.2 128 bits AES128-SHA Server Key Exchange Group(s): TLSv1.3 128 bits secp256r1 (NIST P-256) TLSv1.3 192 bits secp384r1 (NIST P-384) TLSv1.3 260 bits secp521r1 (NIST P-521) TLSv1.3 128 bits x25519 TLSv1.3 224 bits x448 TLSv1.3 112 bits ffdhe2048 TLSv1.3 128 bits ffdhe3072 TLSv1.3 192 bits X25519MLKEM768 TLSv1.2 128 bits secp256r1 (NIST P-256) TLSv1.2 192 bits secp384r1 (NIST P-384) TLSv1.2 260 bits secp521r1 (NIST P-521) TLSv1.2 128 bits x25519 TLSv1.2 224 bits x448 SSL Certificate: Signature Algorithm: sha256WithRSAEncryption RSA Key Strength: 2048 Subject: .estos.local Altnames: DNS:.estos.local, DNS:estos.local Issuer: Enterprise Root CA Not valid before: Jun 17 10:37:03 2026 GMT Not valid after: Jun 16 10:37:03 2028 GMT

Windows SSPI Server

Field	Value
Protocol stack	TCP → TLS (1.1, 1.2, 1.0, 1.3)
Cryptographic provider	SSPI (Security Support Provider Interface) / Schannel
Cipher suites	Windows Schannel cipher suites as configured by the operating system; Windows Server 2022: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022; Windows Server 2025: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2025; Windows 11 >= v22H2: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-11-v22h2

Consuming interface templates

Analytics Client

Field	Value
Protocol stack	TLS
Cryptographic provider	—
Security note	Details müssen noch Documentiert werden

Browser TLS Client (Chromium / Firefox / Safari)

Field	Value
Protocol stack	TLS (1.2, 1.3)
Cryptographic provider	Browser network stack (engine-provided, not application-controlled)
Cipher suites	Abhängig vom Browser und Betriebssystem; nicht aus JavaScript ermittelbar.; Chromium (Chrome; Edge; Opera; Brave): BoringSSL — https:\/\/boringssl.googlesource.com/boringssl/; Firefox: NSS (Network Security Services) — https:\/\/wiki.mozilla.org/NSS; Safari (macOS/iOS): Apple Secure Transport / Network framework — https:\/\/developer.apple.com/documentation/security; Cipher-Intersektion: Browser-Angebot intersect Server-Angebot (z. B. sslscan/SSL Labs am Ziel)
Security note	TLS wird vollständig vom Browser durchgeführt. Die WebApp (JavaScript) hat keinen Zugriff auf Schicht-5-Parameter. Unterstützte Versionen und Cipher Suites hängen von Browser-Version und Betriebssystem ab. Typische Provider: - Chromium-basiert: BoringSSL (gebündelt mit dem Browser) - Firefox: NSS - Safari: Apple Secure Transport TLS 1.0/1.1 sind in aktuellen Browser-Versionen deaktiviert. Das effektive Cipher Suite ergibt sich aus dem Handshake mit dem Server. Unterstützte Browser gemäß estos-Dokumentation

estos Crypto SSPI Client

Field	Value
Protocol stack	TLS (1.0, 1.1, 1.2)
Cryptographic provider	SSPI (Security Support Provider Interface) / Schannel
Cipher suites	Windows Schannel cipher suites as configured by the operating system; Windows Server 2022: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022; Windows Server 2025: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2025; Windows 11 >= v22H2: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-11-v22h2
Security note	TLS 1.3 support is ongoing https:\/\/jira.estos.de/browse/ESPPP-1449

estos Kurento / GStreamer / OpenSSL 1.0.3-dev Client

Field	Value
Protocol stack	DTLS (SSLv3, 1.2)
Cryptographic provider	estos Kurento / GStreamer / OpenSSL 1.0.3-dev

NodeJS 24.13.1 Windows OnPremise Client

Field	Value
Protocol stack	TLS (1.2, 1.3)
Cryptographic provider	NodeJS 24.13.1 / OpenSSL 3.5.5

WebRTC DTLS Client (libwebrtc / BoringSSL)

Field	Value
Protocol stack	DTLS (1.2)
Cryptographic provider	libwebrtc / BoringSSL (Chromium/Edge), NSS (Firefox), or platform WebRTC stack (Safari/iOS/Android)
Security note	DTLS 1.2 for WebRTC ICE TURN over UDP to UCConnect coturn (turn[N].ucconnect.de). Used on coturn tls-listening-port 5349/udp and alt-tls-listening-port 443/udp. Cipher suite from client WebRTC stack intersect coturn OpenSSL server (listening template 45d9e785). TURN credentials from ucturnapi.ucconnect.de REST API. Application code does not control DTLS parameters in browser WebRTC.

WebRTC TURNS TLS Client (libwebrtc / BoringSSL)

Field	Value
Protocol stack	TLS (1.2, 1.3)
Cryptographic provider	libwebrtc / BoringSSL (Chromium/Edge), NSS (Firefox), or platform WebRTC stack (Safari/iOS/Android)
Security note	TLS 1.2/1.3 for WebRTC ICE TURN over TCP/TURNS to UCConnect coturn (turn[N].ucconnect.de). Used on coturn tls-listening-port 5349/tcp and alt-tls-listening-port 443/tcp. Cipher suite from client WebRTC stack intersect coturn OpenSSL RSA cert (listening template 10506178). TURN credentials from ucturnapi.ucconnect.de REST API.

Windows SSPI Client

Field	Value
Protocol stack	TLS (1.1, 1.2, 1.3, 1.0)
Cryptographic provider	SSPI (Security Support Provider Interface) / Schannel
Cipher suites	Windows Schannel cipher suites as configured by the operating system; Windows Server 2022: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022; Windows Server 2025: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2025; Windows 11 >= v22H2: https:\/\/learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-11-v22h2

XCAPI SRTP Client

Field	Value
Protocol stack	SRTP
Cryptographic provider	OpenSSL (7/2026 Version 1.1.1u)
Security note	Die XCAPI direkt kann kein TLS und kein SRTP sondern es muss das Zusatz Modul XSSA (XCAPI SIP Security Add-on) installiert werden. Dieses implementiert SIP TLS und SRTP.