Port 8443 — HTTPS alternate

Q: How do I check if port 8443 is open?

Locally, sudo lsof -i :8443 on macOS or Linux, or netstat -ano | findstr :8443 on Windows. From outside, nc -zv host 8443 tells you whether anything answers.

TCP registered

What runs on port 8443

The unprivileged counterpart to 443, used by Tomcat and many appliances.

The conventional HTTPS equivalent of 8080, used where a process cannot bind 443 without root. Management interfaces for firewalls, appliances and application servers commonly live here — which makes it a high-value target, since a service on 8443 is far more likely to be an administrative console than an ordinary site.

Security considerations

Same exposure as 443 — treat it identically.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :8443
sudo ss -lntp | grep :8443

# Windows
netstat -ano | findstr :8443
Get-NetTCPConnection -LocalPort 8443

# is it reachable from outside?
nc -zv example.com 8443
curl -v telnet://example.com:8443

Freeing the port

# find the process, then stop it
sudo lsof -ti :8443 | xargs kill        # Linux / macOS
netstat -ano | findstr :8443            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

Yes — that is what it is for. Make sure whatever is listening is something you intend to expose, and that TLS is configured properly.

Opening or blocking port 8443

Finding the port is usually the first half of the job. Start narrow — the second rule is there for services that genuinely serve the public, and most do not:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 8443 proto tcp
sudo ufw allow 8443/tcp                   # only if it genuinely serves the public

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=8443 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 8443 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8443 -j DROP

# Windows
New-NetFirewallRule -DisplayName "HTTPS alternate 8443" -Direction Inbound -Protocol TCP -LocalPort 8443 -RemoteAddress 10.0.0.0/8 -Action Allow

10.0.0.0/8 stands in for a private range — substitute your own. Note that a firewall rule does not undo a service bound to 0.0.0.0; it only stops packets reaching it, and a misconfigured or disabled firewall then exposes it immediately.

Quick reference

Port	8443
Protocol	TCP
Service	HTTPS alternate
Range	Registered (1024–49151) — any user process may bind

Frequently asked questions

What is port 8443 used for?

The unprivileged counterpart to 443, used by Tomcat and many appliances.

Is it safe to open port 8443?

Same exposure as 443 — treat it identically.

How do I check if port 8443 is open?

Locally, sudo lsof -i :8443 on macOS or Linux, or netstat -ano | findstr :8443 on Windows. From outside, nc -zv host 8443 tells you whether anything answers.

Why do I get "address already in use" on port 8443?

Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :8443 and stop it, or configure your application to use a different port.

Can I change the port this service uses?

Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.

Other common ports

All port numbers