8443
Summary
- // if you see it open
- Chief risk is exposed HTTPS management consoles: default credentials, weak/outdated TLS, unpatched web apps (e.g. legacy Tomcat Manager). Same TLS/web-app risk profile as 443, but typically a management surface that should not face the internet. Note: CA/Browser Forum 'Authorized Ports' for domain validation excludes 8443.
- // common applications
- Apache TomcatJettypfSenseSynology DSMVMware vCenter
- // analyst note
- An open 8443 is most likely an HTTPS admin/management interface. Enumerate the cert and app, check for default creds, and restrict to VPN/allowlist.
About port 8443/tcp.
Port 8443/tcp is the second of this batch's registered-vs-de-facto cases, and the distinction is the whole point of the page. IANA registers 8443 as pcsync-https with the description "PCsync HTTPS" — a registration tied to Laplink's PCsync file-synchronization product, not to generic HTTPS; the neighbor 8444 is registered as pcsync-http ("PCsync HTTP"), and the reference field is blank. The service that actually answers on 8443 across the modern internet is alternate HTTPS, but "https-alt" is not what the registry says, so that use is de-facto. The protocol carried is identical TLS/HTTPS to port 443 — same certificate handling and TLS handshake, cryptographically no different — chosen because binding 443 requires root on Unix-like systems. In practice 8443 is Apache Tomcat's default SSL/TLS connector and a near-ubiquitous port for web administration and appliance management consoles, Plesk, Kubernetes dashboards, and Plex. Worth noting for tooling: the CA/Browser Forum's list of "Authorized Ports" for domain validation excludes 8443. Security here centers on exposed HTTPS management interfaces — default credentials, weak or outdated TLS, and unpatched web applications (legacy Tomcat Manager being a classic). The risk profile mirrors 443, but 8443 is typically a management surface that should not face the public internet. For an analyst, an open 8443 is most likely an HTTPS admin/management interface; enumerate the certificate and the fronting application, check for default credentials, and restrict access to a VPN or allowlist.
- IANA assignment
pcsync-https— "PCsync HTTPS" (Laplink PCsync); reference (blank — no RFC cited in IANA registry); registered for 8443/tcp and 8443/udp; neighbor 8444 =pcsync-http[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151)
- Prevalence
- in Nmap's default top-1000 TCP ports (de-facto, nmap-services) [Well-established] — nmap-services file
- Related ports
- 443 (HTTPS), 8080 (HTTP-alt), 6443 (Kubernetes API), 8444 (pcsync-http)
De-facto use
alternate HTTPS (NOT the IANA registration)
Primary use (de-facto)
HTTPS on a non-privileged alternate port — Tomcat SSL, admin/appliance consoles
Other/unofficial uses
Plesk, Kubernetes dashboards, Plex, alternate HTTPS generally [Well-established]
Security implications
exposed HTTPS management consoles (default creds, weak TLS, unpatched apps e.g. legacy Tomcat Manager); same TLS/web-app risk profile as 443 but usually a management surface
Typically seen on
appliances, Tomcat/Java servers, control panels, Kubernetes/Plex hosts
- Analyst note
- An open 8443 is most likely an HTTPS admin/management interface. Enumerate the cert and app, check for default creds, and restrict to VPN/allowlist.
About port 8443/udp.
Port 8443/udp shares its IANA registration with the TCP entry: IANA registers 8443 as pcsync-https, description "PCsync HTTPS," a registration tied to Laplink's PCsync file-synchronization product rather than to generic HTTPS. The 8443/tcp and 8443/udp rows in the registry carry the identical service name and description, so this is a genuine dual TCP/UDP registration under one name; the neighbor 8444 is registered as pcsync-http, and the IANA Reference field is blank (no RFC is cited, and none is invented here). The interesting part of the UDP entry is what is NOT true: unlike 8443/tcp — whose de-facto life as alternate HTTPS / Tomcat's SSL connector is well established — there is no comparably documented internet-wide UDP convention for 8443. The obvious analogy would be 443/udp carrying QUIC/HTTP-3, but QUIC conventionally rides UDP 443, not 8443, so that reasoning does not transfer. The one concrete, first-party de-facto UDP-8443 use found is Amazon DCV (Desktop Cloud Visualization): when QUIC support is enabled and no custom UDP port is set, the DCV server defaults its QUIC transport to UDP 8443, mirroring its TCP 8443 default — a specific vendor default, not an internet-wide standard. Generic port-database aggregators (SpeedGuide, tcp-udp-ports.com) list 8443/udp as inheriting the same "pcsync-https"/HTTPS-alternate association as the TCP row, but these are unsourced listings, not observations of real UDP traffic. SANS ISC's port-8443 activity page shows the port under active scanning, but its data aggregates TCP and UDP and cannot attribute volume to UDP specifically. For an analyst, an open 8443/udp is uncommon and under-documented: it most plausibly indicates a QUIC-capable service that defaulted to 8443 (e.g. Amazon DCV) rather than a generic HTTPS listener; identify the fronting application before assuming intent, and do not over-read the shared IANA pcsync-https name as evidence of PCsync traffic.
- IANA assignment
pcsync-https— "PCsync HTTPS" (Laplink PCsync); reference (blank — no RFC cited in IANA registry); registered for 8443/tcp and 8443/udp (identical service name/description on both rows); neighbor 8444 =pcsync-http[Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV lines 11792–11793); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8443- Range class
- registered (1024–49151) [Confirmed]
- Prevalence
- no UDP-specific figure verified; SANS ISC port-8443 activity aggregates TCP+UDP and cannot be split by transport [Unknown] — https://isc.sans.edu/data/port/8443
- Related ports
- 8443/tcp (pcsync-https / HTTPS-alt), 443 (HTTPS; 443/udp = QUIC/HTTP-3), 8444 (pcsync-http)
De-facto UDP use
sparse — no broad internet-wide convention comparable to 443/udp=QUIC; the one concrete sourced example is Amazon DCV's QUIC transport defaulting to UDP 8443 when QUIC is enabled and no custom port is set
Primary use (de-facto)
none well-established for UDP specifically; 8443's familiar alternate-HTTPS/Tomcat role is a TCP phenomenon, not UDP
Other/unofficial uses
generic port-database aggregators list 8443/udp under the same pcsync-https / HTTPS-alt association as TCP, but these are unsourced and not confirmations of real UDP traffic
Security implications
SANS ISC shows port 8443 under active scanning (thousands/day from single source IPs on days observed), but the figure is TCP+UDP combined; no UDP-8443-specific named malware family or CVE identified in this pass
Typically seen on
QUIC-capable services that defaulted to 8443 (e.g. Amazon DCV); otherwise uncommon/under-documented on UDP
- Analyst note
- An open 8443/udp is uncommon. It most plausibly indicates a QUIC-capable app that defaulted to 8443 (e.g. Amazon DCV) rather than a generic HTTPS listener; identify the fronting application and do not read the shared IANA
pcsync-httpsname as evidence of PCsync traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| https-alt | TCP | pcsync-https | 1.00% |
| pcsync-https | UDP | PCsync HTTPS | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.