{
  "port": 443,
  "protocol": "both",
  "service": "HTTPS",
  "oneLiner": "HTTPS — HTTP inside TLS on TCP, and HTTP/3 over QUIC on the UDP side of the same number.",
  "whatItIs": "The TLS handshake authenticates the server with an X.509 certificate and names the target host via SNI, then HTTP/1.1 or HTTP/2 runs inside the encrypted channel; HTTP/3 uses the same port number over UDP with QUIC carrying its own TLS 1.3. This is the default port for essentially every public web service and API, and for a lot of non-web traffic tunneled through it because middleboxes let it pass. On a host, whatever holds 443 is the TLS terminator — a web server, a reverse proxy, or a load balancer agent. An open 443 says almost nothing about what is behind it.",
  "exposure": {
    "verdict": "fine",
    "note": "The intended public port; risk lives in the application behind it and in the TLS configuration, not in the port being open."
  },
  "checkCommand": "openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | head -20",
  "links": [
    {
      "title": "RFC 8446 — The Transport Layer Security (TLS) Protocol Version 1.3",
      "url": "https://www.rfc-editor.org/rfc/rfc8446.html",
      "kind": "spec"
    },
    {
      "title": "RFC 9110 — HTTP Semantics (defines the https URI scheme)",
      "url": "https://www.rfc-editor.org/rfc/rfc9110.html",
      "kind": "spec"
    },
    {
      "title": "nginx ngx_http_ssl_module documentation",
      "url": "https://nginx.org/en/docs/http/ngx_http_ssl_module.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}