443 port TCP is the standard HTTPS port. The TLS handshake happens here. Open inbound in firewall for HTTPS servers. Per Sectigo, the port is essential for encrypted web traffic. The team that has 443 open and a current TLS library has secure HTTPS.
Table of contents
- What runs on 443
- The TLS handshake on 443
- Firewall rules
- Vulnerabilities and patching
- HTTP/3 and QUIC
- The difference from port 80
- FAQ
What runs on 443
TCP 443 is the IANA-registered port for HTTPS:
- HTTPS web traffic.
- WebSocket Secure (wss://).
- HTTP/3 (QUIC over UDP 443).
- mTLS for API auth.
The team that runs a web server has 443 open inbound.
The TLS handshake on 443
When a client connects to 443:
- TCP handshake (SYN, SYN-ACK, ACK).
- TLS ClientHello: supported cipher suites, TLS versions.
- TLS ServerHello: chosen cipher, server cert.
- Cert verification (chain, hostname, expiry).
- Key exchange (TLS 1.3: 1-RTT; TLS 1.2: 2-RTT).
- Encrypted application data.
The team that has TLS 1.3 (default in modern clients) has faster handshakes.
Firewall rules
Allow inbound 443 (HTTPS):
# ufw
sudo ufw allow 443/tcp
# iptables
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPTThe team that has 443 inbound has a public HTTPS server. Most corporate firewalls allow outbound 443.
Vulnerabilities and patching
Notable CVEs on 443:
- Heartbleed (CVE-2014-0160): OpenSSL bug. Patched long ago.
- POODLE (CVE-2014-3566): SSL 3.0. Disable SSL 3.0.
- ROBOT (CVE-2017-13099, etc.): RSA timing attack. Use ECDHE.
- Various TLS implementation bugs.
The team that keeps OpenSSL/SSL libraries updated has current protection.
HTTP/3 and QUIC
HTTP/3 uses QUIC over UDP 443 (not TCP). Modern servers (nginx 1.25+, Caddy, Cloudflare) support it. The team that enables HTTP/3 has better performance on lossy networks.
The difference from port 80
- 80: HTTP (plaintext).
- 443: HTTPS (TLS).
- 80 -> 443: redirect.
The team that has both ports handles old http:// links gracefully.
FAQ
Is port 443 TCP or UDP?
TCP for HTTPS. UDP/443 for HTTP/3 (QUIC). Most firewalls allow both.
Why is 443 the default for HTTPS?
IANA-registered in the late 1990s when SSL/TLS became standard. Has stuck.
Can I use a different port for HTTPS?
Yes - any unused port (8443, 7443, etc.). The team that uses non-standard has fewer drive-by scans but the user has to know the port.
Do I need to open 443 on my firewall?
Yes for inbound HTTPS. Most firewalls allow outbound 443 by default.
What’s the speed difference between 80 and 443?
Negligible. TLS adds <1ms latency on modern CPUs. The team that has both ports has no perf difference.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: