TCP Port 8443 – HTTPS Alternate (alt-HTTPS)
Port 8443 is the most common alternative port for HTTPS web traffic, the encrypted counterpart to port 8080’s plain HTTP. Like 8080, it sits in the high-numbered range above 1024, which means services running on it do not need administrator or root privileges to bind to the port on most operating systems. That practical convenience is why 8443 became the de facto alt-HTTPS port even though no formal IANA assignment names it as such; the IANA registry actually lists 8443 as “pcsync-https,” a legacy registration from a long-discontinued PC synchronization product, but real-world usage has thoroughly displaced this meaning.
Port 8443 shows up most often in three contexts. First, application server admin interfaces: VMware vCenter, Tomcat administration consoles, Plesk web hosting control panels, and many enterprise software products default to TLS-protected web admin on 8443. Second, self-signed-certificate deployments: a service that needs encryption but does not have a public-CA certificate (often because it was never meant to face the internet) lands on 8443 with a locally generated certificate. Third, internal HTTPS services behind a corporate firewall, where binding to 443 would conflict with a primary public-facing service or where high ports avoid permission requirements.
When port 8443 is part of a public-facing production deployment, it is almost always behind a reverse proxy. The application server listens on 8443 internally with a self-signed or internal certificate, and a front-end web server accepts public HTTPS connections on port 443 and forwards them onward.
Outbound TCP/8443 from end-user devices is uncommon outside specific application contexts. Inbound TCP/8443 to a host that is not an admin endpoint, application server, or development service is unusual and worth investigating.
About TCP Port 8443
The Internet Assigned Numbers Authority (IANA) registers port 8443 for pcsync-https. The IANA description reads: ‘PCsync HTTPS’.
Security Considerations
Port 8443 inherits the broader web-application threat landscape that affects any HTTP-bearing port. The IDS rules referencing this port are led by the web-application-attack and web-application-activity classtypes, most of them generic web signatures rather than anything specific to this port. Many of the same malware families appear, including Zeus, Emotet (MITRE S0367), the Cobalt Strike framework (S0154), and the ZeroAccess botnet (S0027). As with port 8080, most rules that target HTTP-based attacks are written to fire on whichever port carries the traffic, so a high rule count on 8443 reflects this overlap rather than 8443-specific threats.
What gives port 8443 a distinct security profile is the certificate situation. Public-facing HTTPS on port 443 almost always uses a certificate issued by a trusted public certificate authority, which both proves the server’s identity and trains users to expect a green padlock. Port 8443, by contrast, is heavily associated with self-signed certificates and internal certificate authorities. Browsers respond with prominent warnings, which trains users (especially administrators) to click through certificate errors as a matter of routine. That habit weakens one of the central protections TLS is supposed to provide: the assurance that the user is connecting to the genuine server rather than a man-in-the-middle.
Common practice for organizations is to issue certificates to all internal services from an internal certificate authority that is trusted by managed devices, eliminating the warning click-through and restoring the identity guarantee. Where that is not feasible, restricting access to a known network range or placing the service behind a VPN reduces the attack surface even if the certificate itself remains self-signed.
Inbound TCP/8443 to a host that is not a designated admin interface, application server, or development environment is worth investigating. Sustained outbound TCP/8443 from an end-user device to unfamiliar destinations is uncommon for normal browsing patterns and is occasionally seen in malware command-and-control traffic that uses non-standard HTTPS ports to evade port-based filtering.
IDS Rule References
2038 IDS / security rules reference TCP port 8443. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.
Rule categories (top 6): trojan-activity (729), web-application-activity (476), web-application-attack (344), attempted-recon (270), misc-activity (76), attempted-user (58).
Sample rule descriptions for TCP port 8443:
- SERVER-WEBAPP PCCS mysql database admin tool access
- SERVER-WEBAPP HyperSeek hsx.cgi directory traversal attempt
- SERVER-WEBAPP SWSoft ASPSeek Overflow attempt
- SERVER-WEBAPP Progress webspeed access
- SERVER-WEBAPP yabb directory traversal attempt
Malware Rule References
A meaningful share of the IDS rules that reference this port are malware related.
681 of the 2038 IDS rules that reference TCP port 8443 are malware related. That describes detection coverage across the whole internet, not anything about your machine or your network.
Families observed (top 8): Bancos (20), Fareit (15), Zeus (15), DesertFalcon (11), Symmi (11), Zebrocy (11), Chopper (10), Locky (9), and 261 more families.
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).