Port 8443 – HTTPS Alternate

TCP

Port 8443 is the standard alternate HTTPS port – used when port 443 is unavailable or reserved. Common in development, Kubernetes ingress controllers, application servers running without root, and Tomcat. Browsers do not auto-redirect to 8443; the port must be specified explicitly in URLs.

Port Number

8443

Protocol

TCP

Service

HTTP over TLS (alternate)

Range

IANA Registered (1024–49151)

Description

Port 8443 mirrors port 443 but without the need for root/elevated privileges on Linux (ports below 1024 require root). Kubernetes, Tomcat, WildFly, and many development servers use 8443 for HTTPS. Unlike 443, accessing 8443 requires an explicit port in the URL: https://app.example.com:8443. Reverse proxies typically map port 443 to 8443 in production.

Security risks

1Self-signed certificates: development instances on 8443 frequently use self-signed certs that browsers reject. Users trained to click through certificate warnings become vulnerable to real MITM attacks. Use mkcert for local development or Let's Encrypt for anything network-accessible.
2Bypass of port-443 security controls: WAF rules, IDS signatures, and DLP policies often monitor only port 443. Services on 8443 may bypass these controls entirely. Ensure security monitoring covers all HTTPS ports, not just 443.
3Kubernetes admission webhook exposure: Kubernetes admission controllers listen on 8443. Misconfigured NetworkPolicies allowing external access to 8443 could let attackers inject or modify Kubernetes resources via webhook manipulation.

Firewall guidance

In production, do not expose port 8443 directly to the internet. Use a reverse proxy on port 443 that forwards to 8443 internally. In Kubernetes, admission webhooks on 8443 should be accessible only from the API server (NetworkPolicy restricting source to kube-apiserver pods). Development instances must bind to 127.0.0.1:8443.

Diagnosis commands

Test TLS certificate on alternate HTTPS port

shell

openssl s_client -connect host:8443 -servername host

Check HTTP response (skip cert validation for self-signed)

shell

curl -kI https://host:8443/

Identify which process owns port 8443

shell

ss -tnlp sport = :8443

Usage examples

Port 8443 – HTTPS Alternate

shell

curl https://localhost:8443
openssl s_client -connect localhost:8443
kubectl get service --all-namespaces | grep 8443

Common services on this port

Apache TomcatKubernetes admission webhooksWildFly/JBossSpring BootJenkins (HTTPS)VMware vCenterUnifi Controller

Related ports

443

HTTPS (standard, requires root)

8080

HTTP alternate

4443

HTTPS alternate (Kubernetes)

History

Port 8443 became the de facto alternate HTTPS port in the early 2000s when Apache Tomcat chose it as default SSL port (port 443 required root). The convention spread to all Java application servers and eventually to Kubernetes and container ecosystems.

FAQ

Why not just use port 443?

On Linux, binding to ports below 1024 requires root (or CAP_NET_BIND_SERVICE). Application servers running as non-root users cannot bind to 443 directly. A reverse proxy (Nginx/Caddy) running as root on 443 forwards to the application on 8443.