Port reference
Port 8443 (TCP) – HTTPS Alternate
Alternate TLS web port for admin consoles, Tomcat HTTPS connectors, and network appliances.
Quick facts
- Transport
- tcp
- Category
- Registered
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open when an app server or appliance exposes an HTTPS admin UI. Often reachable from the internet on firewalls, VPNs, and management consoles.
What is port 8443 used for?
Port 8443 is a widely used alternate HTTPS port. It is the default for Apache Tomcat's SSL connector and for the web admin consoles of many firewalls, VPN gateways, and other network appliances, typically chosen when port 443 is already taken. Unlike plain HTTP on 8080, traffic on 8443 is TLS-encrypted by design.
When would you open it?
Open or forward 8443 when you run an HTTPS service or appliance admin console on it and need remote access. For admin interfaces specifically, most people keep it on a management network or behind a VPN rather than exposing it to the whole internet.
Is it safe to open?
8443 often fronts admin consoles that are prime targets, and TLS protects the channel but not weak passwords, so require strong authentication and limit who can reach it. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8443
nmap -p 8443 <target>netstat -ano | findstr :8443
Test-NetConnection <host> -Port 8443lsof -i :8443
nmap -p 8443 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8443 to your device's local IP, internal port 8443, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8443/tcpsudo firewall-cmd --permanent --add-port=8443/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8443 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8443" -Direction Inbound -Protocol TCP -LocalPort 8443 -Action AllowSecurity & risks
Common attacks
- Exposed admin consoles with default or weak credentials
- Appliance and VPN management RCE chains (firewalls, gateways)
- TLS misconfiguration and weak/expired certificate abuse
- Scanning for known web-app and Tomcat SSL vulnerabilities
Hardening
- Restrict 8443 admin UIs to management VLANs or VPN, not the internet
- Enforce strong auth and MFA; remove default accounts
- Use valid certificates and modern TLS; disable weak ciphers
- Patch the appliance/app server and monitor admin logins
- IP-allowlist access and rate-limit authentication
How to block this port
sudo ufw deny 8443/tcpsudo firewall-cmd --permanent --remove-port=8443/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8443 -j DROPNew-NetFirewallRule -DisplayName "Block 8443" -Direction Inbound -Protocol TCP -LocalPort 8443 -Action Blocknmap snippet
nmap -p8443 --script ssl-cert,ssl-enum-ciphers,http-title <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 8443 used for?
- It is a common alternate HTTPS port, used for Tomcat's SSL connector and for web admin consoles on firewalls, VPNs, and appliances when port 443 is taken. Traffic is TLS-encrypted by design.
- Is it safe to expose port 8443?
- Only with care. 8443 frequently fronts admin consoles that are prime targets for credential attacks and appliance RCE. Restrict it to management networks or VPN, enforce MFA, and keep the software patched.