Skip to main content
protocols.pageprotocols.page
443

Port 443 – HTTPS / HTTP/2 / HTTP/3

TCP

Port 443 is the default port for HTTPS, HTTP/2, and HTTP/3 (over QUIC/UDP). All three use TLS encryption. Port 443 is the most critical port in web infrastructure – practically all modern web traffic passes through it. HTTP/3 uses UDP port 443 via QUIC.

Port Number

443

Protocol

TCP

Service

HTTP over TLS

Range

IANA Well-Known (0–1023)

Description

HTTPS on port 443 encrypts all web traffic using TLS. HTTP/2 also runs over port 443 with TLS, multiplexing many requests over one connection. HTTP/3 uses QUIC over UDP port 443 with independent stream loss recovery. Firewalls that block UDP 443 force fallback to HTTP/2 over TCP 443. The Alt-Svc header tells clients when HTTP/3 is available. Port 443 carries effectively all modern web traffic – browsing, APIs, WebSocket (wss://), gRPC, and even DNS-over-HTTPS. It is the one port that every corporate firewall allows outbound, making it the universal tunnel for any protocol that wants to traverse restrictive networks.

Security risks

  • 1Certificate expiry: expired TLS certificates on port 443 cause hard browser errors and API failures. Monitor with certbot renew or external checkers (uptimerobot, ssllabs.com).
  • 2TLS misconfiguration: supporting TLS 1.0/1.1 or weak ciphers (3DES, RC4) enables downgrade attacks. Test with: ssllabs.com/ssltest or testssl.sh.
  • 3Missing HSTS: without Strict-Transport-Security header, the first request can be intercepted via sslstrip on port 80 before redirect.
  • 4Wildcard exposure: a wildcard certificate (*.example.com) on port 443 means compromising one subdomain's key exposes all subdomains.
  • 5SNI leakage: the hostname is sent in cleartext in TLS ClientHello (visible to network observers). ECH (Encrypted Client Hello) mitigates this but adoption is still growing.

Firewall guidance

Port 443 outbound must be allowed – blocking it breaks all HTTPS. Inbound 443 should be open only on servers explicitly serving web traffic. Use TLS termination at the load balancer rather than exposing application servers directly. For defense-in-depth, deploy a WAF (Cloudflare, AWS WAF, ModSecurity) in front of port 443 to filter malicious requests before they reach application code.

Diagnosis commands

Check TLS certificate validity and HTTP response in one shot

shell
curl -vI https://host 2>&1 | grep -E '(SSL|subject|expire|HTTP)'

Show certificate validity dates

shell
openssl s_client -connect host:443 -servername host < /dev/null 2>/dev/null | openssl x509 -noout -text | grep -A2 'Validity'

Enumerate all supported TLS versions and cipher suites

shell
nmap --script ssl-enum-ciphers -p 443 host

Comprehensive TLS security audit (checks BEAST, POODLE, Heartbleed, weak ciphers)

shell
testssl.sh host:443

Measure TCP connect + TLS handshake + total time

shell
curl -w 'time_connect: %{time_connect}
time_appconnect: %{time_appconnect}
time_total: %{time_total}
' -so /dev/null https://host

Count active connections to port 443

shell
ss -tnp | grep ':443' | wc -l

Usage examples

Port 443 – HTTPS / HTTP/2 / HTTP/3
shell
curl https://example.com
openssl s_client -connect example.com:443
curl --http3 https://example.com
echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -dates

Common services on this port

NginxApache httpdCaddyHAProxyEnvoyCloudflare CDNAWS ALB/NLBTraefikNode.js (Express/Fastify)IIS

Related ports

80

HTTP (redirects to 443)

8443

HTTPS alternate

4443

HTTPS alternate (Kubernetes)

853

DNS over TLS

History

Port 443 was assigned for HTTPS in 1994 alongside the original SSL protocol by Netscape. HTTP/2 standardized in 2015 (RFC 7540) mandated TLS in practice through browser enforcement. HTTP/3 (RFC 9114, 2022) moved to QUIC over UDP 443, the first major transport change for web traffic since TCP's adoption. The Alt-Svc mechanism allows servers to advertise HTTP/3 availability so clients upgrade transparently.

FAQ

Does HTTP/3 use TCP or UDP port 443?

HTTP/3 uses UDP port 443 via the QUIC protocol. QUIC provides its own reliable delivery, encryption (TLS 1.3 built-in), and stream multiplexing – replacing both TCP and TLS. TCP port 443 continues serving HTTP/1.1 and HTTP/2 for clients that do not support QUIC.

Why do some firewalls block UDP 443?

Legacy firewalls and corporate proxies that perform TLS inspection cannot inspect QUIC (encryption is built into the transport, not layered on top). They block UDP 443 to force clients back to TCP 443 where they can perform man-in-the-middle inspection. This is why HTTP/3 always has a TCP fallback.

Can I run non-HTTPS services on port 443?

Technically yes – SSLH or HAProxy can multiplex SSH, OpenVPN, and HTTPS on port 443 by detecting the protocol in the first few bytes. This is used to bypass restrictive firewalls that only allow outbound 443. However, DPI systems can detect non-TLS protocols even on port 443.

Specification

RFC 9110 – Port 443 specification →