Port 443 HTTPS – Free, Online, Private

What listens on 443

Port 443 is HTTPS. The IANA name is https, http protocol over TLS/SSL, cited to RFC 9110. A browser given an https URL with no port connects here, completes TLS, and then speaks HTTP on the inside. The certificate has to name the host. IANA lists TCP, UDP, and SCTP. TCP is classic HTTPS. UDP 443 is where HTTP/3 and QUIC show up in practice, which is a different protocol on the same number, not a typo. A load balancer that terminates TLS owns this port. The application behind it may listen on something else entirely.

The IANA service name is https: http protocol over TLS/SSL. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 443. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 443

Service notes for port 443: the IANA name is https (http protocol over TLS/SSL), and the program people mean is HTTPS. TCP 443 is the IANA https port, HTTP over TLS. Browsers use it by default. UDP 443 is also QUIC. The private key for the certificate is the secret. The port being 443 is not. Serve current TLS, redirect 80 to 443, and do not offer the application on a second cleartext port. A certificate that does not match the name, or that has expired, fails the browser even though nc -vz succeeds. That distinction matters: the TCP port is open and the service is still not acceptable. Mutual TLS is a configuration on this port, not a different port. An alternate HTTPS listener on 8443 will not be tried by a browser that was given a normal URL. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 443, you are on the wrong page.

Something else already bound to 443 is why the proxy will not start. ss names it. A container that listens on 443 and is published as 8443 is a different public port. Clients using https://host/ never see it. Another failure is a firewall that allows 443 and a security group that does not, or the reverse, depending on which cloud console you edited. Another is testing QUIC with a TCP tool. UDP 443 can be open while you are staring at a TCP success and still wondering why HTTP/3 will not negotiate.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 443 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. TCP 443 on the public edge should complete, and a TLS handshake should present the certificate you just issued. curl -I https://host/ checks both. nc checks only TCP. If you serve HTTP/3, also look for UDP 443.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• nc -vz succeeding does not mean the certificate is valid. TLS is the next step.
• UDP 443 is QUIC when you have enabled it. It is not what a TCP-only health check measures.
• Port 8443 is a common alternate and is not where browsers go.
• A redirect from 80 does not keep 443 open by itself. Both listeners have to exist.

Linuxsudo ss -lptn 'sport = :443'
sudo lsof -nP -iTCP:443 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:443 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.443[^0-9]'

Windowsnetstat -ano | findstr :443
Get-NetTCPConnection -LocalPort 443

Remotenc -vz host 443