{
  "port": 8443,
  "protocol": "tcp",
  "service": "HTTPS alternate",
  "oneLiner": "The TLS counterpart to 8080: HTTPS on an unprivileged port.",
  "whatItIs": "IANA has 8443 registered as pcsync-https, but in practice it is the conventional alternate HTTPS port. Tomcat's shipped SSL connector example uses 8443, and appliance web UIs, Kubernetes-adjacent services and admin consoles commonly serve TLS there. A listener on 8443 speaks TLS, so a plain HTTP request to it will fail.",
  "exposure": {
    "verdict": "careful",
    "note": "TLS on the wire is not authentication — check the certificate and what the service behind it lets an anonymous caller do."
  },
  "checkCommand": "openssl s_client -connect 127.0.0.1:8443 -servername localhost </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 8443",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8443",
      "kind": "iana"
    },
    {
      "title": "Apache Tomcat 11 — SSL/TLS Configuration HOW-TO (connector on 8443)",
      "url": "https://tomcat.apache.org/tomcat-11.0-doc/ssl-howto.html",
      "kind": "official-docs"
    }
  ],
  "ianaName": "pcsync-https"
}