# WHATPORT(443)

## NAME

port 443 — HTTPS — HTTPS — HTTP inside TLS on TCP, and HTTP/3 over QUIC on the UDP side of the same number.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

The TLS handshake authenticates the server with an X.509 certificate and names the target host via SNI, then HTTP/1.1 or HTTP/2 runs inside the encrypted channel; HTTP/3 uses the same port number over UDP with QUIC carrying its own TLS 1.3. This is the default port for essentially every public web service and API, and for a lot of non-web traffic tunneled through it because middleboxes let it pass. On a host, whatever holds 443 is the TLS terminator — a web server, a reverse proxy, or a load balancer agent. An open 443 says almost nothing about what is behind it.

## EXPOSURE

**Fine to expose.** The intended public port; risk lives in the application behind it and in the TLS configuration, not in the port being open.

## CHECK

```sh
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | head -20
```

## SEE ALSO

- spec — [RFC 8446 — The Transport Layer Security (TLS) Protocol Version 1.3](https://www.rfc-editor.org/rfc/rfc8446.html) (rfc-editor.org)
- spec — [RFC 9110 — HTTP Semantics (defines the https URI scheme)](https://www.rfc-editor.org/rfc/rfc9110.html) (rfc-editor.org)
- docs — [nginx ngx_http_ssl_module documentation](https://nginx.org/en/docs/http/ngx_http_ssl_module.html) (nginx.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/443/> · JSON: <https://whatport.net/443.json> · full dataset: <https://whatport.net/ports.json>