Which port does TLS use, and is there a separate SSL port?

TLS has no port of its own. It wraps another protocol, and each protocol picks a port. HTTPS uses TCP 443. Secure mail submission uses 465, IMAP uses 993, POP3 uses 995, LDAP uses 636, and DNS over TLS uses 853. "SSL port" is an old name for the same thing.

Why does everyone say "SSL port"?

SSL was the original protocol from the 1990s. TLS replaced it, and the name stuck in menus, firewall templates and vendor docs. The IANA registry still describes port 443 as "http protocol over TLS/SSL". In 2021 RFC 8996 formally deprecated TLS 1.0 and 1.1, and TLS 1.3 was published in 2018 as RFC 8446. So a port labelled SSL today should be carrying TLS 1.2 or 1.3, never SSL itself.

The port tells you which application is expected. It says nothing about the TLS version or cipher. Two services on 443 can differ completely in strength.

Which ports are registered for TLS wrapped protocols?

From the IANA service name and port registry:

• 443/tcp, https: HTTP over TLS.
• 465/tcp, submissions: message submission over TLS, registered through RFC 8314.
• 587/tcp, submission: message submission, which usually starts in plain text and upgrades.
• 993/tcp, imaps: IMAP over TLS.
• 995/tcp, pop3s: POP3 over TLS.
• 636/tcp, ldaps: LDAP over TLS.
• 853/tcp, domain-s: DNS over TLS, defined in RFC 7858.
• 8883/tcp, secure-mqtt: MQTT over TLS, relevant for IoT.
• 990/tcp, ftps: FTP control channel over TLS.

The mail ports show a real distinction. Port 465 starts the TLS handshake immediately. This is "implicit TLS". Port 587 begins with a plain connection and the client asks to upgrade, which is "STARTTLS". RFC 8314 recommends implicit TLS for POP, IMAP and submission. It says implicit TLS has been deployed more successfully than STARTTLS and that recommending it encourages wider and more consistent use of TLS. With STARTTLS the client starts in clear text and decides whether to upgrade.

Does a closed port mean traffic is not encrypted?

No. Services can run TLS on any port. An admin console on 8443 or a database listener on a custom port is common. Registered numbers are conventions, not rules, so scanning only the well known list will miss things. Also, the IANA registry lists 443 for UDP as well as TCP, so a TCP only scan does not see everything on that number.

A constructed example

Say a team opens 443, 993 and 587 on a mail gateway and calls it hardened. An audit finds three issues. Port 587 accepts login before the upgrade to TLS has happened. The IMAP listener still offers TLS 1.0. And a webmail admin page answers on 8443 with a certificate that expired last spring. None of these show up in a port list. All of them show up when you connect and read what the server offers.

How to check or apply this

1. List listening ports on each host, not just the ones in your firewall template. Compare against what the host is meant to run.
2. For every TLS service, record the protocol versions and cipher suites it accepts. Disable TLS 1.0 and 1.1 as RFC 8996 directs.
3. For mail, prefer implicit TLS on 465 for submission and 993 for IMAP, as RFC 8314 recommends. If you keep 587, require the upgrade before authentication.
4. Check certificate validity dates, hostnames and chain on each service, including internal ones.
5. Re-run the check on a schedule, because configuration drifts with every package update.
6. Document the exceptions. A legacy device that cannot do TLS 1.2 belongs on an isolated segment with a named owner and an end date.

Quick check

Sources

• IANA Service Name and Transport Protocol Port Number Registry
• RFC 8446, TLS 1.3
• RFC 8996, Deprecating TLS 1.0 and TLS 1.1
• RFC 8314, Cleartext Considered Obsolete: Use of TLS for Email Submission and Access
• RFC 7858, DNS over TLS

Last reviewed: 18 October 2026.