SSL/TLS port 443 for HTTPS. STARTTLS upgrades plaintext to TLS on the same port (587 SMTP, 143 IMAP, 110 POP3). Implicit TLS uses dedicated ports: 465 (SMTPS), 993 (IMAPS), 995 (POP3S). The team that picks the right port for the protocol has correct service config.
Table of contents
- HTTPS port 443
- STARTTLS vs implicit TLS
- Email protocol ports
- Other common TLS ports
- SSL vs TLS
- Configure for HTTPS
- FAQ
HTTPS port 443
TLS-secured HTTP runs on port 443 (per the GoDaddy guide):
- HTTPS: 443 (TLS from start).
- HTTP: 80 (plaintext).
The team that runs a web server exposes 443 for HTTPS. Most modern browsers default to HTTPS on port 443.
STARTTLS vs implicit TLS
Two patterns for adding TLS to plaintext protocols:
- STARTTLS: starts as plaintext, upgrades to TLS via command. Same port as plaintext.
- Implicit TLS: starts with TLS from connection. Dedicated port.
The team that uses STARTTLS has compatibility (older clients can still use plaintext with fallback). The team that uses implicit TLS has stricter security (no plaintext fallback).
Email protocol ports
| Protocol | Plaintext | STARTTLS | Implicit TLS |
|---|---|---|---|
| SMTP (send) | 25 | 587 | 465 |
| IMAP (read) | 143 | 143 | 993 |
| POP3 (download) | 110 | 110 | 995 |
The team that runs email services has these ports configured.
Other common TLS ports
- 636: LDAPS (LDAP over TLS).
- 989/990: FTPS (FTP over TLS).
- 5061: SIPS (SIP over TLS).
- 8443: HTTPS alt (common for dev/admin UIs).
- 9443: HTTPS alt (WSO2, etc.).
The team that has dev/admin UIs uses 8443 or 9443 to avoid privileged port.
SSL vs TLS
SSL (Secure Sockets Layer) is the deprecated predecessor to TLS (Transport Layer Security). The team that uses “SSL port” colloquially actually means TLS port - SSL 3.0 has been deprecated since 2015.
Configure for HTTPS
On nginx:
server {
listen 443 ssl http2;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}The team that has TLS config and 443 open has HTTPS working.
FAQ
What’s the difference between SSL and TLS?
SSL 3.0 is deprecated. TLS 1.0, 1.1 also deprecated. TLS 1.2 and 1.3 are current. The team that uses modern TLS has current security.
What port should HTTPS use?
443 (default). The team that uses non-standard (8443) is usually behind a reverse proxy on 443.
Is STARTTLS or implicit TLS better?
Implicit TLS is more secure (no plaintext fallback). STARTTLS is more compatible with old clients. The team that uses implicit TLS for new services has stricter security.
Do I need to open port 80 for HTTPS?
Yes - for ACME HTTP-01 challenge (Let’s Encrypt) and for HTTP -> HTTPS redirect. The team that has 80 closed can’t renew certs or redirect.
What about port 8443?
Common alt for HTTPS on dev/admin UIs. The team that uses 8443 doesn’t need root for binding.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: