Why Port 443 is being used by System Process with PID 4

Question

Why Port 443 is being used by System Process with PID 4, (ntoskrnl.exe) In Windows Server 2012 R2. I need to configure this port with Apache. But unable to do this, because its already in used.

Answer 1

Most probably, that's http.sys, the kernel-mode side of the new Windows HTTP stack. It does system-wide port sharing and caching for web servers who are his clients (think of it as a kernel-mode nginx reverse proxy where your web servers can register), but of course it doesn't play well with web servers which want to listen directly on HTTP and HTTPS ports by themselves.¹

Still, you can either disable it or change the address where it is listening; keep in mind that the http.sys service is started on demand, so if it is running on your system it's because some component asked for it, and may misbehave if you disable it; here is a list of typical services which require http.sys (but most probably you just have IIS running).

---

1. Also, if you ask me it's batshit insane to have a kernel-mode component parsing HTTP unless the required performance leave you no other choice, but that shouldn't be the default choice by any means - as MS15-034 teaches us, a small bug means BSOD-level DoS and kernel-mode remote code execution.

Answer 2

Stop the WinRM service - Windows Remote Management (WS-Management) using following command:

net stop winrm

Answer 3

Try this:

• Run net stop http - this will stop the http service (and dependant services)

   The following services are dependent on the HTTP Service service.
   Stopping the HTTP Service service will also stop these services.
  
     SSDP Discovery
     Print Spooler
     Routing and Remote Access
     HomeGroup Provider
     Function Discovery Resource Publication
     Function Discovery Provider Host
  

Try starting your server after this, if the server starts it means one of the above services is using port 443