Port 443: HTTPS

What uses port 443

Browsers connect to 443 for every https:// URL without a port. TCP 443 carries HTTP/1.1 and HTTP/2 over TLS; UDP 443 carries HTTP/3 over QUIC, so open both for full performance. Because 443 is allowed through almost every firewall, other protocols often tunnel over it too, such as DNS over HTTPS, WebSockets and some VPNs.

Should port 443 be open to the internet?

Meant to be public. This port is meant to be reachable by clients on the internet when you run this service publicly.

• Only TCP 443 open? HTTP/3 silently falls back to HTTP/2, which works but is slower on lossy networks. Allow UDP 443 to enable QUIC.
• Certificate errors on 443 are about the certificate, not the port. Check the names and expiry with the certificate decoder.
• Behind a load balancer, TLS often terminates there and the app listens on plain HTTP (80, 8080). Make sure the app trusts X-Forwarded-Proto to build correct URLs.

Check what is listening on port 443

sudo ss -ltnp 'sport = :443'
sudo ss -lunp 'sport = :443'

sudo lsof -nP -iTCP:443 -sTCP:LISTEN
sudo lsof -nP -iUDP:443

Get-NetTCPConnection -LocalPort 443 -State Listen
Get-NetUDPEndpoint -LocalPort 443
netstat -ano | findstr :443

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 443

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:443 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 443 -State Listen).OwningProcess

Open port 443 in the firewall

sudo ufw allow 443/tcp
sudo ufw allow 443/udp
# Close it again:
sudo ufw delete allow 443/tcp

sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --permanent --add-port=443/udp
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "HTTPS 443/TCP" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
New-NetFirewallRule -DisplayName "HTTPS 443/UDP" -Direction Inbound -Protocol UDP -LocalPort 443 -Action Allow

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 443 with Docker

docker run -d -p 443:443 nginx

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 443 from another machine

nc -zv example.com 443

Test-NetConnection example.com -Port 443

Related ports

• Port 80 (HTTP): the default port for HTTP, unencrypted web traffic.
• Port 8443 (HTTPS alternate): a common alternate HTTPS port.
• Port 853 (DNS over TLS): used by DNS over TLS (DoT) for encrypted DNS queries.
• Port 3478 (STUN / TURN): used by STUN and TURN servers for WebRTC and VoIP NAT traversal.

More web ports

8080 (HTTP alternate) . See all ports in the port lookup.

Sources

• IANA port registry: 443

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions