The other alternate HTTPS port after 8443 — usually an appliance admin UI or a container that cannot bind 443.
IANA registers 4443 as pharos, but almost nothing you meet is that. The port survives as a convention: it is above 1024, so an unprivileged process can bind it, and it visually echoes 443, so vendors and container images pick it for a second TLS listener. Expect appliance and management consoles, secondary reverse-proxy endpoints, and sidecar services serving HTTPS to something else in the cluster. Whatever answers is a TLS server, so the certificate usually names the product for you.
Expose with care
TLS is a floor, not a verdict: 4443 most often fronts an administrative UI, so treat it as an admin plane unless you have confirmed it is a public application endpoint.
$ openssl s_client -connect TARGET:4443 -servername TARGET </dev/null 2>/dev/null | openssl x509 -noout -subject -issuerSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.