{
  "port": 4443,
  "protocol": "tcp",
  "service": "Alternate HTTPS (IANA: pharos)",
  "oneLiner": "The other alternate HTTPS port after 8443 — usually an appliance admin UI or a container that cannot bind 443.",
  "whatItIs": "IANA registers 4443 as pharos, but almost nothing you meet is that. The port survives as a convention: it is above 1024, so an unprivileged process can bind it, and it visually echoes 443, so vendors and container images pick it for a second TLS listener. Expect appliance and management consoles, secondary reverse-proxy endpoints, and sidecar services serving HTTPS to something else in the cluster. Whatever answers is a TLS server, so the certificate usually names the product for you.",
  "exposure": {
    "verdict": "careful",
    "note": "TLS is a floor, not a verdict: 4443 most often fronts an administrative UI, so treat it as an admin plane unless you have confirmed it is a public application endpoint."
  },
  "checkCommand": "openssl s_client -connect TARGET:4443 -servername TARGET </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer",
  "links": [
    {
      "title": "IANA port registry — 4443 (pharos)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=4443",
      "kind": "iana"
    }
  ]
}