TCP Port 8443 – HTTPS Alternate (alt-HTTPS)
Port 8443 is the most common alternative port for HTTPS web traffic, the encrypted counterpart to port 8080’s plain HTTP. Like 8080, it sits in the high-numbered range above 1024, which means services running on it do not need administrator or root privileges to bind to the port on most operating systems. That practical convenience is why 8443 became the de facto alt-HTTPS port even though no formal IANA assignment names it as such; the IANA registry actually lists 8443 as “pcsync-https,” a legacy registration from a long-discontinued PC synchronization product, but real-world usage has thoroughly displaced this meaning.
Port 8443 shows up most often in three contexts. First, application server admin interfaces: VMware vCenter, Tomcat administration consoles, Plesk web hosting control panels, and many enterprise software products default to TLS-protected web admin on 8443. Second, self-signed-certificate deployments: a service that needs encryption but does not have a public-CA certificate (often because it was never meant to face the internet) lands on 8443 with a locally generated certificate. Third, internal HTTPS services behind a corporate firewall, where binding to 443 would conflict with a primary public-facing service or where high ports avoid permission requirements.
When port 8443 is part of a public-facing production deployment, it is almost always behind a reverse proxy. The application server listens on 8443 internally with a self-signed or internal certificate, and a front-end web server accepts public HTTPS connections on port 443 and forwards them onward.
Outbound TCP/8443 from end-user devices is uncommon outside specific application contexts. Inbound TCP/8443 to a host that is not an admin endpoint, application server, or development service is unusual and worth investigating.
About TCP Port 8443
The Internet Assigned Numbers Authority (IANA) registers port 8443 for pcsync-https. The IANA description reads: ‘PCsync HTTPS’.
Security Considerations
Port 8443 inherits the broader web-application threat landscape that affects any HTTP-bearing port. Our data shows 2,065 IDS rules referencing this port, with web-application-attack and web-application-activity classtypes leading at over 800 rules combined. Many of the same malware families appear, including Zeus (15 rules), Emotet (MITRE S0367, 13 rules), the Cobalt Strike framework (S0154), and the ZeroAccess botnet (S0027). As with port 8080, most rules that target HTTP-based attacks are written to fire on whichever port carries the traffic, so a high rule count on 8443 reflects this overlap rather than 8443-specific threats.
What gives port 8443 a distinct security profile is the certificate situation. Public-facing HTTPS on port 443 almost always uses a certificate issued by a trusted public certificate authority, which both proves the server’s identity and trains users to expect a green padlock. Port 8443, by contrast, is heavily associated with self-signed certificates and internal certificate authorities. Browsers respond with prominent warnings, which trains users (especially administrators) to click through certificate errors as a matter of routine. That habit weakens one of the central protections TLS is supposed to provide: the assurance that the user is connecting to the genuine server rather than a man-in-the-middle.
Common practice for organizations is to issue certificates to all internal services from an internal certificate authority that is trusted by managed devices, eliminating the warning click-through and restoring the identity guarantee. Where that is not feasible, restricting access to a known network range or placing the service behind a VPN reduces the attack surface even if the certificate itself remains self-signed.
Inbound TCP/8443 to a host that is not a designated admin interface, application server, or development environment is worth investigating. Sustained outbound TCP/8443 from an end-user device to unfamiliar destinations is uncommon for normal browsing patterns and is occasionally seen in malware command-and-control traffic that uses non-standard HTTPS ports to evade port-based filtering.
IDS Rule References
2038 IDS / security rules reference TCP port 8443. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 6): trojan-activity (729), web-application-activity (476), web-application-attack (344), attempted-recon (270), misc-activity (76), attempted-user (58).
Sample rule descriptions for TCP port 8443:
- SERVER-WEBAPP PCCS mysql database admin tool access
- SERVER-WEBAPP HyperSeek hsx.cgi directory traversal attempt
- SERVER-WEBAPP SWSoft ASPSeek Overflow attempt
- SERVER-WEBAPP Progress webspeed access
- SERVER-WEBAPP yabb directory traversal attempt
Malware Activity
A meaningful share of monitored traffic on this port involves malware indicators.
681 of 2038 IDS rules for TCP port 8443 involve malware activity.
Families observed (top 8): Bancos (20), Fareit (15), Zeus (15), DesertFalcon (11), Symmi (11), Zebrocy (11), Chopper (10), Locky (9), and 261 more families.
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).