Port 443 (HTTPS)

HTTP over TLS: almost every website and API. TCP 443 carries HTTP/1.1 and HTTP/2; UDP 443 carries HTTP/3 over QUIC, so browsers try UDP 443 when a server advertises h3 in Alt-Svc or an HTTPS DNS record.

Well-known (system) port, 0-1023 TCPUDP Web Meant to face the internet

What port 443 is used for

Security: should port 443 be open?

Meant to face the internet. Meant to be public. Keep TLS 1.2+ only, renew certificates before they expire and patch the web server or reverse proxy. Most attacks here target the application (injection, auth bypass, exposed admin paths), not the port itself. If you block UDP 443, HTTP/3 clients fall back to TCP 443.

IANA assignment

Service nameProtoDescriptionAssigneeReference

https TCP http protocol over TLS/SSL IESG RFC 9110

https UDP http protocol over TLS/SSL IESG RFC 9110

https SCTP HTTPS Randall Stewart RFC 9260

Registry dates for this port: last modified 2022-02-07.

Check what is listening on port 443

Linux: is anything listening on TCP 443?

sudo ss -tlnp 'sport = :443'

Linux: UDP 443

sudo ss -ulnp 'sport = :443'

Linux / macOS: which process owns the port

sudo lsof -nP -i :443

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':443 '

Windows (Command Prompt)

netstat -ano | findstr :443

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 443 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 443

From Windows

Test-NetConnection HOST -Port 443

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 443

Open port 443 in the firewall

ufw

sudo ufw allow 443/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

nftables

sudo nft add rule inet filter input tcp dport 443 accept

Windows Firewall

New-NetFirewallRule -DisplayName 'Allow TCP 443' -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

ufw

sudo ufw allow 443/udp