Skip to main content
protocols.pageprotocols.page
7443

Port 7443 – Openfire BOSH SSL

TCP

Port 7443 is the Openfire XMPP server TLS-encrypted HTTP binding (BOSH) port. Web-based XMPP clients use port 7443 for encrypted long-polling connections when direct TLS TCP on port 5222 is not available. This is the secure equivalent of port 7070. Also used by some application servers as an alternate HTTPS port.

Port Number

7443

Protocol

TCP

Service

Openfire HTTP Binding (TLS)

Range

IANA Registered (1024–49151)

Description

Openfire serves encrypted HTTP binding (BOSH) on port 7443, providing TLS-secured XMPP-over-HTTP for web chat clients. JavaScript XMPP libraries like Strophe.js and Converse.js connect to this port when WebSocket is unavailable and direct TCP to port 5222 is blocked. Port 7443 is also used as a generic alternate HTTPS port by various applications – Oracle Unified Directory, some API gateways, and custom application servers that cannot use port 443. When encountered on a network scan, context determines the service. For Openfire specifically, port 7443 should have a valid TLS certificate to prevent browser security warnings for web chat users.

Security risks

  • 1CVE-2023-32315 (CVSS 7.5): Openfire path traversal via admin console – unauthenticated attacker bypasses authentication to access admin panel and installs malicious plugins for RCE. Exploited in the wild. Affects port 7443 when admin console is accessible via BOSH endpoint. Fixed in 4.7.5/4.6.8
  • 2Self-signed TLS certificates: Openfire generates a self-signed cert on install. Web clients connecting to 7443 see browser warnings, training users to click through – making them vulnerable to real MITM attacks
  • 3BOSH session hijacking: if an attacker obtains a BOSH session ID (via XSS or network sniffing on misconfigured intermediate proxies), they can take over the XMPP session and read/send messages as the victim

Firewall guidance

Expose port 7443 only if web-based XMPP clients are needed. Prefer WebSocket (wss:// on port 443 via reverse proxy) over BOSH for modern deployments. If BOSH is required, proxy through Nginx on 443 with a proper Let's Encrypt certificate rather than exposing 7443 directly. Ensure the admin console (port 9090/9091) is NOT accessible through the BOSH port.

Diagnosis commands

Check TLS certificate on BOSH SSL port

shell
openssl s_client -connect host:7443 -servername host

Test BOSH endpoint availability (should return 200 or 400)

shell
curl -sk https://host:7443/http-bind/ -o /dev/null -w '%{http_code}'

Audit TLS configuration on Openfire BOSH

shell
nmap -sV -p 7443 --script ssl-enum-ciphers target

Usage examples

Port 7443 – Openfire BOSH SSL
shell
curl -k https://xmpp.example.com:7443/http-bind/
openssl s_client -connect host:7443
converse.js: bosh_service_url: 'https://host:7443/http-bind/'

Common services on this port

OpenfireProsody (BOSH)ejabberd (BOSH/WebSocket)Converse.jsStrophe.js

Related ports

7070

Openfire HTTP binding (plaintext BOSH)

5222

XMPP client-to-server (direct TCP)

5269

XMPP server-to-server federation

9091

Openfire Admin Console (HTTPS)

History

Openfire added HTTP binding (BOSH, XEP-0124/XEP-0206) to enable web-based XMPP clients that cannot open direct TCP sockets. Port 7070 serves plaintext BOSH, port 7443 serves TLS-encrypted BOSH. The ports were chosen to avoid conflicts with Openfire's admin console (9090/9091) and standard XMPP ports (5222/5269). WebSocket support (RFC 7395) is gradually replacing BOSH for web clients.

FAQ

BOSH vs WebSocket for web XMPP clients?

WebSocket (wss:// on port 443): lower latency, true bidirectional, single connection, works through all proxies with proper upgrade headers. BOSH (port 7443): long-polling, HTTP-based, works through restrictive proxies that block WebSocket upgrades. Prefer WebSocket for all new deployments. Use BOSH only as fallback for environments where WebSocket is blocked.