Certificate Services across a Firewall

Hi all,

I have a DC behind a Firewall. I need to renew the subCA certificate with a
certificate server on the other side of the firewall. This uses RPC, so I
need 135 and a randomly assigned high port.

I know how to lock down the RPC high ports for Directory Services etc, but
unsure which registry key to set to lockdown the RPC high port for
Certificate Services.

Any Geniuses (Genii?) out there who can help?

Thanks

Martyn