System requirements · 3.2
Ports and listeners
TLSPilot uses the following ports by default.
| Listener | Default | Notes |
|---|---|---|
| WebUI HTTPS | TCP 8443 | Default binding when the WebUI is enabled (Enterprise and higher). The WebUI is off until you enable it in the Initial Setup Wizard or in the settings on the tab WebUI. |
| WebUI HTTP | TCP 8080 | Optional and disabled by default. |
| Private CA CDP/OCSP | TCP 8088 | Only active while the Private CA is running (Professional and higher). |
| Management API | 127.0.0.1:5188 | Only reachable locally on the management host. |
| TLS-ALPN-01 challenge | TCP 443 (public) | Behind NAT, the local port may differ. |
| HTTP-01 challenge | TCP 80 (public) | Only if TLSPilot answers the challenge itself (publish mode Listener on this management host). Behind NAT, the local port may differ. |