Port 8443 is where secure, high-performance web services often live. It is the default for HTTPS over an alternative to port 443, and it’s a common choice for admin interfaces, APIs, and control panels. Mercurial can run there when configured to serve over HTTPS, giving teams encrypted transport without fighting over default ports in shared environments. The problem is most people only think about 8443 when it’s already on fire.
When Mercurial listens on 8443, you’re usually trying to run a safe, private repository host without exposing it unnecessarily. That means SSL/TLS, firewall rules, load balancers, and reverse proxies need to be in perfect sync. A misstep in any layer—wrong cert, bad proxy header, closed port at the firewall—leads to downtime. Debugging this under pressure is painful. Logs are your friend, but so is knowing the handshake chain by heart. If 8443 refuses traffic, confirm that your Mercurial hg serve or your WSGI deployment is bound to the correct interface, that your certificates are trusted and current, and that your infrastructure actually forwards the packets where they should go.
Security is the other half of the story. Running Mercurial over 8443 instead of plain HTTP means encrypting source code in transit. That prevents snooping, tampering, and credential theft. But encryption is only useful if the service is hardened. Update Mercurial itself. Patch your web server. Use TLS 1.2 or higher. Disable weak ciphers. Monitor for unauthorized access attempts.