{
  "port": 9443,
  "protocol": "tcp",
  "service": "HTTPS alternate (Portainer, WSO2, appliance consoles)",
  "oneLiner": "The default second HTTPS port — usually a management UI in a Java or container stack.",
  "whatItIs": "IANA registered 9443 to WSO2 as tungsten-https, and WSO2 products still serve their management console over it. The port became the generic \"HTTPS on a non-privileged port\" convention: Portainer publishes its UI on 9443, Tomcat and other Java servers commonly pair 9443 with 9080/8080, and a long list of network appliances use it for their web admin. Expect TLS and an administrative login page.",
  "exposure": {
    "verdict": "careful",
    "note": "The transport is encrypted, but what sits behind it is usually a full administrative console — often with a default certificate and, on appliances, default credentials. Restrict it to a management network."
  },
  "checkCommand": "curl -skI --max-time 5 https://TARGET:9443/",
  "links": [
    {
      "title": "IANA port registry — 9443 (tungsten-https)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9443",
      "kind": "iana"
    },
    {
      "title": "Portainer — install Portainer Server (UI on 9443)",
      "url": "https://docs.portainer.io/start/install-ce/server/docker/linux",
      "kind": "official-docs"
    }
  ]
}