Skip to content

Connectivity and browser policies

CIS1 authentication depends on HSCN. CIS2 can authenticate over the internet. Migration decisions must also account for the applications used on the workstation. SRC-012

Published domain boundary

Use Domain Applicability
CIS2 authentication am.nhsidentity.spineservices.nhs.uk Internet-facing service
Care Identity Management manage-care-identities.care-identity-service2.nhs.uk Internet-facing service
Target application Application-specific domain Add the actual service used
Legacy authentication gas.national.ncrs.nhs.uk Identity Agent configuration
Legacy Credential Management route trustedurl.national.ncrs.nhs.uk Identity Agent configuration

NHS guidance specifies domain names rather than fixed IP addresses. Its HSCN entries are conditional on legacy Identity Agent use; they are not an automatic modern-workstation requirement. SRC-006

This table is not an exhaustive packet-level specification for every issuance, certificate, proxy or update transaction. DNS and outbound HTTPS/TLS are design dependencies. Certificate validation paths and gateway behaviour must be observed on the intended network, without inventing additional mandatory NHS endpoints.

The local browser path matters

NHS troubleshooting guidance describes targeted cookie exceptions and Chromium Local Network Access permissions for the relevant service origins. Apply production entries for production use; integration environments have separate addresses. Prefer the documented site-specific exceptions over globally enabling third-party cookies. SRC-010

Browser-to-local middleware communication is distinct from internet egress. A firewall allowlist alone will not prove that both paths work.

Local network acceptance

  1. Record the DNS, proxy, VPN and filtering path actually used by the workstation.
  2. Confirm access to CIM and the selected authentication route as the intended operator.
  3. Check browser-to-local service access under the managed browser policies.
  4. Run issue-and-print through the same path, with HSCN unavailable if independence is the objective.
  5. Review scoped diagnostic evidence for unexpected dependencies and failures.
  6. Record the result in acceptance, including unsuccessful attempts.

Test TLS inspection compatibility under the organisation's change process. This wiki does not prescribe disabling inspection, bypassing controls or an unverified cipher list. See VAL-001.