Port 8443HTTPS alternate

What port 8443 is used for

When a machine already serves a website on 443, or the software does not run with the privileges needed to bind a low port, HTTPS services move to 8443. It is the default TLS port for:

• Apache Tomcat SSL connectors, and by extension many Java applications.
• Hosting control panels such as Plesk.
• Network controllers and appliances: UniFi, some VMware and Cisco management interfaces, storage arrays.
• Kubernetes admission webhooks and various operators.
• Development whenever a local HTTPS server is needed alongside an HTTP one on 8080.

The registration versus the convention

The IANA registry lists 8443 as pcsync-https, a service registered by a specific vendor. That registration has nothing to do with the general practice of running web consoles there. This matters in one practical way: a port scanner or firewall product that labels 8443 as "PCsync" is reading the registry, not identifying the application. Confirm what is actually listening before drawing conclusions.

Security considerations

• Self-signed certificates are common on 8443 admin consoles. That is acceptable on a management network but means users cannot distinguish the real console from an impostor. Install a certificate from an internal or public CA where possible.
• Admin consoles should not face the internet. A management interface on 8443 exposed to the public with default credentials is a frequent entry point. Restrict to a management VLAN or VPN.
• Same TLS hygiene as 443: disable TLS 1.0/1.1, use modern cipher suites, renew certificates.

How to check port 8443

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :8443

A line in the LISTENING state means a local program has bound port 8443; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :8443 or lsof -i :8443.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection example.com -Port 8443

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 8443. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Inspect the certificate presented on 8443, ignoring trust errors so the output shows details:

curl -vk https://host.example.com:8443/ -o NUL

Firewall considerations

Treat 8443 like 443: allow inbound only to the hosts that must serve it, and only from the networks that should reach the console. Because so many management products default to 8443, an internet-wide scan for the port finds a great many exposed panels; restrict it deliberately rather than by accident.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 8443 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.