What runs on port 443
TCP port 443 is the default port for HTTPS: HTTP inside a TLS connection. The browser and server first agree on keys and the server presents a certificate for the hostname; only then does HTTP start, so URLs, headers, cookies and bodies are encrypted. Nearly all web traffic, and most API traffic, uses 443.
Since HTTP/3, port 443 also matters on UDP. HTTP/3 runs over QUIC, which uses UDP 443. Browsers start on TCP and switch to HTTP/3 when the server advertises it with an Alt-Svc header; if UDP 443 is blocked, they quietly stay on HTTP/2 over TCP.
Other things you will meet on 443: DNS over HTTPS, many VPNs (because 443 is rarely blocked), and WebSocket connections opened with wss://.
Should it be open to the internet?
On a public web server, yes. Open TCP 443, and UDP 443 too if you serve HTTP/3:
sudo ufw allow 443/tcp
sudo ufw allow 443/udp
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p udp --dport 443 -j ACCEPT
Keep port 80 open as well so plain http:// requests can be redirected.
A basic nginx server block
server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
add_header Strict-Transport-Security "max-age=31536000" always;
}
The http2 on; directive needs nginx 1.25.1 or newer; older versions use listen 443 ssl http2;. Always serve the full chain (fullchain.pem), not just the leaf certificate, or some clients will fail to verify it.
One IP address can serve many sites on 443 because the client sends the hostname in the TLS handshake (SNI), and the server picks the matching certificate.
See what is listening
sudo ss -tulnp 'sport = :443'
sudo lsof -i :443
From outside:
curl -I https://example.com
openssl s_client -connect example.com:443 -servername example.com
"Port 443 already in use"
nginx reports bind() to 0.0.0.0:443 failed (98: Address already in use) when another process has the port. Usual causes: Apache installed alongside nginx, a Docker container publishing 443, Caddy or Traefik running as a proxy, or a VPN server such as OpenVPN set to listen on 443. Find the process with ss -tlnp, stop the one you don't want, or move one service behind the other as a reverse proxy on a port such as 8443.
Security notes
- Expired or mismatched certificates are the most common HTTPS failure. Automate renewal and monitor expiry.
- Disable TLS 1.0 and 1.1; all current browsers support 1.2 and 1.3.
- Send HSTS once HTTPS works everywhere, so browsers stop trying port 80 first.
- Don't expose admin panels on 443 just because it's encrypted; encryption is not access control.
Related
- Port 80 (HTTP): the unencrypted port that should redirect here.
- Port 8443: the common alternative HTTPS port.
- CAA record: which certificate authorities may issue for your domain.
Check the certificate and TLS version your server presents with the SSL Checker, and its HTTPS headers with the Security Headers Checker.