Port 8443 HTTPS alternate – Free, Online, Private

What listens on 8443

The assigned name is pcsync-https, PCsync HTTPS, on TCP and UDP. The widely deployed use is an application server's TLS listener, Tomcat and friends, chosen because 443 needs privilege and 8443 does not. That use is convention. IANA did not rename the port to https-alt. A client has to be told the port. Browsers do not try 8443 when 443 fails. The certificate still has to name the host. UDP is in the registry and is not TLS. Kubernetes dashboards and admin tools have used 8443 in sample manifests. Those samples are not a reason to publish it.

The IANA service name is pcsync-https: PCsync HTTPS. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 8443. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 8443

Service notes for port 8443: the IANA name is pcsync-https (PCsync HTTPS), and the program people mean is HTTPS alternate. TCP 8443 is the IANA pcsync-https port, PCsync HTTPS. Application servers use it as an unofficial alternate HTTPS port. The registered HTTPS port remains 443. An alternate TLS port is easy to forget in a review that only looks at 443. Include it. The certificate, the authentication, and the audience should be the same standard you apply to the public site, or stricter if this is an admin UI. Mutual TLS is common on 8443 in management APIs. A client that skips verification because the port is 'internal' will accept a different internal host. Do not publish an admin 8443 to the internet and rely on the port number. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 8443, you are on the wrong page.

A security group allows 443 and the admin UI is on 8443, so operators conclude the UI is down. Another trap is a certificate for the public name installed on 443 and a self-signed certificate left on 8443. Browsers warn, and a health check that does not verify TLS says it is fine. Another is a redirect from 8080 to https://host:8443 that leaks the internal port into a public URL. Another is HTTP spoken on 8443 by a misconfigured connector. The client sends a ClientHello and gets an HTTP status line, or the reverse.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 8443 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. A TLS handshake should complete and name the host you configured. The process is the application server, not necessarily anything called pcsync. A cleartext HTTP response means the connector is the wrong one.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• The IANA name is pcsync-https. Alternate HTTPS is the common unofficial use.
• 443 is the HTTPS port browsers use. 8443 has to be explicit.
• UDP 8443 is not TLS.
• Forgetting 8443 in a firewall review is how an admin UI stays exposed.

Linuxsudo ss -lptn 'sport = :8443'
sudo lsof -nP -iTCP:8443 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:8443 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.8443[^0-9]'

Windowsnetstat -ano | findstr :8443
Get-NetTCPConnection -LocalPort 8443

Remotenc -vz host 8443