Port 443 (HTTPS)
Web traffic over TLS, and the transport for many APIs and VPNs.
- Transport
- TCP
- Internet exposure
- Public by design
Normally public, but keep the software patched and hardened.
Security notes
- Most malware command-and-control traffic now uses HTTPS to blend in.
- Look at certificates, SNI and JA3/JA4 fingerprints, since the content is encrypted.
- Many VPN appliances listen on 443, and they are heavily targeted when vulnerabilities are announced.
When it shows up in your logs
Outbound 443 to newly registered domains, to raw IPs, or at regular beaconing intervals deserves investigation.