<!-- Derived Markdown alternate of connectivity.md; canonical repository sources and registered evidence retain authority. -->


# Connectivity and browser policies

CIS1 authentication depends on HSCN. CIS2 can authenticate over the internet. Migration decisions must also account for the applications used on the workstation. [SRC-012](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-012)

## Published domain boundary

| Use | Domain | Applicability |
|---|---|---|
| CIS2 authentication | `am.nhsidentity.spineservices.nhs.uk` | Internet-facing service |
| Care Identity Management | `manage-care-identities.care-identity-service2.nhs.uk` | Internet-facing service |
| Target application | Application-specific domain | Add the actual service used |
| Legacy authentication | `gas.national.ncrs.nhs.uk` | Identity Agent configuration |
| Legacy Credential Management route | `trustedurl.national.ncrs.nhs.uk` | Identity Agent configuration |

NHS guidance specifies domain names rather than fixed IP addresses. Its HSCN entries are conditional on legacy Identity Agent use; they are not an automatic modern-workstation requirement. [SRC-006](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-006)

This table is not an exhaustive packet-level specification for every issuance, certificate, proxy or update transaction. DNS and outbound HTTPS/TLS are design dependencies. Certificate validation paths and gateway behaviour must be observed on the intended network, without inventing additional mandatory NHS endpoints.

## The local browser path matters

NHS troubleshooting guidance describes targeted cookie exceptions and Chromium Local Network Access permissions for the relevant service origins. Apply production entries for production use; integration environments have separate addresses. Prefer the documented site-specific exceptions over globally enabling third-party cookies. [SRC-010](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-010)

Browser-to-local middleware communication is distinct from internet egress. A firewall allowlist alone will not prove that both paths work.

## Local network acceptance

1. Record the DNS, proxy, VPN and filtering path actually used by the workstation.
2. Confirm access to CIM and the selected authentication route as the intended operator.
3. Check browser-to-local service access under the managed browser policies.
4. Run issue-and-print through the same path, with HSCN unavailable if independence is the objective.
5. Review scoped diagnostic evidence for unexpected dependencies and failures.
6. Record the result in [acceptance](https://nhs-smartcard-printing-wiki.pages.dev/acceptance/index.md), including unsuccessful attempts.

Test TLS inspection compatibility under the organisation's change process. This wiki does not prescribe disabling inspection, bypassing controls or an unverified cipher list. See [VAL-001](https://nhs-smartcard-printing-wiki.pages.dev/validation-queue/index.md#val-001).