HTTPS and SSH on same port

Some Internet specialist organizations and corporate organizations may have blocked the greater part of the ports, and permitted just a couple of particular ports, for example, port 80 and 443 to fix their security. In such cases, we must choose between limited options, yet utilize the same port for different projects, say the HTTPS Port 443, which is once in a while blocked. Here is the place SSLH, an SSL/SSH multiplexer, comes in offer assistance. It will tune in for approaching associations on a port 443. To put this all the more just, SSLH enables us to run a few projects/benefits on port 443 on a Linux framework. In this way, you can utilize both SSL and SSH utilizing a same port in the meantime. On the off chance that you at any point been in a circumstance where most ports are obstructed by the firewalls, you can utilize SSLH to get to your remote server.

This brief tutorial describes how to share the same port for https, ssh using SSLH in Unix-like operating systems.

SSLH – Share The Same Port For HTTPS, SSH, And OpenVPN Install SSLH

SSLH is packaged for most Linux distributions, so you can install it using the default package managers.

On Arch Linux and derivatives like Antergos, Manjaro Linux, install it using Pacman as shown below.

sudo pacman -S sslh  

On Debian, Ubuntu, and derivatives, run:

sudo apt-get install sslh  

On RHEL, CentOS, you need to add EPEL repository and then install SSLH as shown below.

sudo yum install epel-release  
sudo yum install sslh  

On Fedora:

sudo dnf install sslh  

The output should look like this:


Configure Apache or Nginx webservers

As you already know, Apache and Nginx webservers will listen on all network interfaces (i.e by default. We need to change this setting to tell the webserver to listen on the localhost interface only (i.e or localhost:443).

To do so, edit the webserver (nginx or apache) configuration file and find the following line:

listen 443 ssl;  

And, change it to:

listen ssl;  

If you’re using Virutalhosts in Apache, make sure you have changed that it too.


Save and close the config files. Do not restart the services. We haven’t finished yet.

  • Configure SSLH

Once you have made the webservers to listen on the local interface only, edit SSLH config file:

nano /etc/sslh.cfg  

You may configure various settings here, but the most important adjustment is to put the section with your external address name to "" which means that service is going to listen to all network addresses on the same server. Other than that you can configure user running and other things. Here is how my config file on test CentOS 7 server looks like:

~]# cat /etc/sslh.cfg 
# This is a basic configuration file that should provide
# sensible values for "standard" setup.

verbose: false;  
foreground: true;  
inetd: false;  
numeric: false;  
transparent: false;  
timeout: 2;  
user: "root";

# Change hostname with your external address name.
    { host: ""; port: "443"; }

     { name: "ssh"; service: "ssh"; host: ""; port: "22"; },
     { name: "openvpn"; host: ""; port: "1194"; },
     { name: "xmpp"; host: ""; port: "5222"; },
     { name: "http"; host: ""; port: "80"; },
     { name: "ssl"; host: ""; port: "443"; log_level: 0; },
     { name: "anyprot"; host: ""; port: "443"; }

Save and close the file.

Now enable sslh service and start it:

systemctl enable sslh  

And start it:

systemctl start sslh  

You may use lsof command to see what is now listening on the 443 port:

And now you can test and connect to your server and use Multiplexer service:

> ssh -p 443's password:  
Last login: Sun Nov 12 20:44:07 2017 from  
[user@malizeleni1 ~]$ hostname  
[user@malizeleni1 ~]$

You are now able to access the remote server via SSH even if the default SSH port 22 is blocked. As you see in the above example, I have used the https port 443 for SSH connection. Also, we can use the same port 443 for OpenVPN connections too. For more details, check the project’s website URL given below.

Alternatively, you can adjust/swap your Nginx and/or Apache to alternative port (for ex 4433 or whatever) and then adjust the sslh.cfg file with that port, for example:

{ name: "ssl"; host: "localhost"; port: "4433"; log_level: 0; },

You may done the same with any other service/port and/or protocol and use this Multiplexer in that purpose.


SSLH website (

Hope this article helps you to organize more secure environment within your corporate and/or private network, or at least to override when using public Wi-Fi hotspots.