Server 2K3 R2 Firewall & Certificate Services

What ports need to be open for a Server 2k3 R2 Enterprise CA to function
correctly? The machine in question is not a domain controller, but is a
member server in the domain. Only one domain in the forest. I would like
to use the MMC snapin on my XP machines (all at SP2) to get certificates. I
would prefer to not activate ASP on IIS.

I did a google search and only came up with one post that was remotely
connected from Steve Umbach where he was helping someone diagnose a problem
and said "turn off windows firewall on your server 2003 server".

So I wondered what exceptions I have to configure if I have it turned on?

Thanks for any info,

Joe