Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why Port 443 is being used by System Process with PID 4

Why Port 443 is being used by System Process with PID 4, (ntoskrnl.exe) In Windows Server 2012 R2. I need to configure this port with Apache. But unable to do this, because its already in used.

enter image description here

like image 383
ehsantarar Avatar asked Dec 23 '16 05:12

ehsantarar


2 Answers

Try this:

  • Run net stop http - this will stop the http service (and dependant services)

     The following services are dependent on the HTTP Service service.
     Stopping the HTTP Service service will also stop these services.
    
       SSDP Discovery
       Print Spooler
       Routing and Remote Access
       HomeGroup Provider
       Function Discovery Resource Publication
       Function Discovery Provider Host
    

Try starting your server after this, if the server starts it means one of the above services is using port 443

like image 172
Gabi Dj Avatar answered Oct 23 '22 11:10

Gabi Dj


Most probably, that's http.sys, the kernel-mode side of the new Windows HTTP stack. It does system-wide port sharing and caching for web servers who are his clients (think of it as a kernel-mode nginx reverse proxy where your web servers can register), but of course it doesn't play well with web servers which want to listen directly on HTTP and HTTPS ports by themselves.1

Still, you can either disable it or change the address where it is listening; keep in mind that the http.sys service is started on demand, so if it is running on your system it's because some component asked for it, and may misbehave if you disable it; here is a list of typical services which require http.sys (but most probably you just have IIS running).


  1. Also, if you ask me it's batshit insane to have a kernel-mode component parsing HTTP unless the required performance leave you no other choice, but that shouldn't be the default choice by any means - as MS15-034 teaches us, a small bug means BSOD-level DoS and kernel-mode remote code execution.
like image 43
Matteo Italia Avatar answered Oct 23 '22 12:10

Matteo Italia