829

Port 829 is registered with IANA as pkix-3-ca-ra with the description "PKIX-3 CA/RA," assignee and contact Carlisle Adams, and a blank reference field on both the TCP and UDP rows (verified against the live registry CSV, Last Updated 2026-05-29); the registry does not cite an RFC even though CMP is defined by RFC 2510 and later RFC 4210. It is the default TCP listener port on a Registration Authority or Certification Authority for the Certificate Management Protocol (CMP), carrying ASN.1 DER-encoded PKIMessage sequences as CMP "TCP-Messages." CMP is the protocol by which PKI entities — end entities, RAs, and CAs — request and manage X.509 certificates, covering initialization, certification, key update and renewal, and revocation requests, using the MIME media type application/pkixcmp; CMP messages are self-contained with their own signature- or MAC-based protection, which makes the protocol transport-independent and gives it end-to-end security even across multiple hops. The standardization lineage runs RFC 2510 (1999) to RFC 4210 (CMPv2, 2005), with the Lightweight CMP Profile RFC 9483 (November 2023, targeting industrial and IoT use) and the consolidated RFC 9810 (2025); an important nuance is that modern CMP overwhelmingly uses HTTP(S) transfer (RFC 6712 and successors) rather than raw TCP 829, so the TCP-829 transport is the original and legacy mechanism while HTTP-based transport is now generally preferred. The IANA reference field is blank. Security-wise a CA or RA enrollment interface is an extremely high-value target — its compromise enables issuance of trusted certificates — so it must be tightly access-controlled and network-isolated. For an analyst, an open 829 indicates a PKI/CA or RA enrollment endpoint, which is rare on the public internet; nmap-services lists 829/tcp at 0.000125 and 829/udp at 0.001982.

IANA assignment

pkix-3-ca-ra — "PKIX-3 CA/RA"; reference (blank — no RFC cited in IANA registry despite CMP RFC 4210); assignee/contact Carlisle Adams; dual-registered 829/tcp + 829/udp (identical rows) [IANA-assigned, verified live] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low; nmap-services 829/tcp 0.000125, 829/udp 0.001982 (de-facto) [Well-established] — nmap-services file

Related ports

EST (RFC 7030, over 443), ACME (RFC 8555, over 443), SCEP

Primary use

CMP certificate management between PKI entities (CA/RA)

Other/unofficial uses

modern CMP prefers HTTP(S) transfer (RFC 6712) over raw TCP 829 [Well-established]

Security implications

a CA/RA enrollment interface is an extremely high-value target (issuance of trusted certs); tightly access-control and network-isolate [Well-established]

Typically seen on

PKI/CA and RA enrollment servers (EJBCA, Nexus, Entrust; OpenSSL ≥3.0, Bouncy Castle)

Analyst note

An open 829 indicates a PKI/CA or RA enrollment endpoint — rare on the public internet; treat the CA/RA interface as extremely high-value and isolate it.