Port 8443: alternative HTTPS port explained

What port 8443 is

TCP port 8443 is the most common alternative to port 443 for HTTPS. It plays the same role for encrypted traffic that port 8080 plays for plain HTTP: a port above 1024 that a service can bind without root, or a second HTTPS endpoint next to the main site. Traffic is TLS-encrypted like any HTTPS.

Software that uses 8443 by default includes:

Apache Tomcat, its TLS connector in the sample configuration.
Plesk, the control panel's HTTPS interface.
UniFi Network controllers, the web interface.
Many appliances and admin consoles, such as firewalls and VPN gateways.
Kubernetes API servers in some distributions and local setups.

Should it be open to the internet?

It depends on what listens there. A panel like Plesk is designed to be reached remotely, but you can still restrict it to your own addresses. Admin consoles for routers, firewalls and VPN appliances are a frequent target of automated attacks, and vendors regularly publish urgent fixes for them, so limit them to a management network or VPN when you can.

For an application server, the usual pattern is the same as with 8080: terminate TLS in a reverse proxy on 443 and keep the backend private.

server {
    listen 443 ssl;
    server_name app.example.com;
    location / {
        proxy_pass https://127.0.0.1:8443;
        proxy_set_header Host $host;
    }
}

Firewall rules

Allow only your office or VPN range:

sudo ufw allow from 203.0.113.0/24 to any port 8443 proto tcp
sudo ufw deny 8443/tcp

ufw applies the first matching rule, so add the allow before the deny. With iptables:

sudo iptables -A INPUT -p tcp --dport 8443 -s 203.0.113.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8443 -j DROP

How to check what is listening

sudo ss -tlnp | grep ':8443'
sudo lsof -i :8443

Test the TLS handshake and certificate from another machine:

openssl s_client -connect example.com:8443 -servername example.com </dev/null
curl -vI https://example.com:8443/

Services on 8443 often use a self-signed certificate generated at install time, so browsers show a warning. Replace it with a certificate from a public CA (Let's Encrypt works for any port, since validation happens on 80 or through DNS) and make sure the name matches the host you type.

"Port 8443 already in use"

Find the process with sudo lsof -i :8443 (on Windows, netstat -ano | findstr :8443), then stop it or move one service. In Tomcat, change the port of the TLS Connector in conf/server.xml; in Spring Boot, set server.port; in Docker, map another host port such as -p 9443:8443.

8443 behind a CDN

Cloudflare proxies HTTPS on a fixed set of ports, which includes 8443, so a site can be served through it on that port. The origin still needs a firewall, or visitors can skip the CDN.

Port 443: standard HTTPS.
Port 8080: the alternative HTTP port.
Port 80: plain HTTP.

Scan a host for an open 8443 with the Port Scanner, and check its certificate with the SSL Checker.