iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
When Nginx cannot bind to port 443, the error code tells you where to look. (98: Address already in use) means another process already owns the HTTPS port. (13: Permission denied) means Nginx lacks permission to open a privileged port, or a security policy is blocking it. Identify the exact error, find the process or policy involved, correct that condition, test the configuration, and only then restart Nginx.
Read the error before changing anything
Check the Nginx error output or the service journal. These messages look similar but require different fixes:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Message | Meaning | First action |
|---|---|---|
bind() to 0.0.0.0:443 failed (98: Address already in use) |
Another socket is listening on port 443, or a second Nginx instance is trying to use the same address. | Identify the listener with ss or lsof. |
bind() to 0.0.0.0:443 failed (13: Permission denied) |
The Nginx process is not permitted to open the privileged port, or SELinux/AppArmor or another policy denied it. | Check how Nginx is launched, then inspect security-policy denials. |
Error starting userland proxy: listen tcp4 0.0.0.0:443: bind: address already in use |
A container runtime could not publish host port 443 because another service has it. | Find the host listener and the container publishing configuration. |
The address can be more specific than 0.0.0.0. An IPv6 listener such as [::]:443, or a listener bound to one particular IP address, can still conflict with the address Nginx needs.
Diagnose who owns port 443
Use ss first
On most current Linux distributions, run:
sudo ss -tlnp | grep ':443'The output shows listening TCP sockets and, when available, the process name and PID. Look for entries on 0.0.0.0:443, [::]:443, or the server’s specific public address. If the command returns a process, record its name and PID before stopping anything.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Use lsof when process details are missing
sudo lsof -i :443This can reveal the command, user, PID and file descriptor associated with the port. A service may appear under a wrapper process, so use the PID to inspect its parent and service unit before killing it.
Check the Nginx service and processes
systemctl status nginx
ps aux | grep nginxA failed systemd start can leave an older master process running. Conversely, a manually launched Nginx may be using a different configuration or PID file than the systemd unit. Do not assume that the process named nginx belongs to the service you just restarted.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Look for containers and bundled add-ons
Docker, Podman, reverse-proxy bundles, control panels and self-hosted add-ons commonly publish host port 443. List running containers and inspect their published ports:
sudo docker ps
sudo podman psUse the runtime’s port-inspection command if necessary. A container mapping such as 0.0.0.0:443->443/tcp reserves the host port even though the application runs inside the container. Community reports also describe finding the conflict by stopping add-ons one at a time; do that only during a controlled maintenance window because it can interrupt unrelated services.
Search Nginx configuration for duplicate listeners
A second listen 443 line is not automatically wrong: several server blocks can share a port when their addresses and names are configured correctly. The problem is an incompatible duplicate, a second Nginx master, or a stale included file. Search the complete configuration tree, including files included from nginx.conf:
sudo grep -RIn --include='*.conf' 'listen[[:space:]].*443' /etc/nginxThen inspect the effective configuration rather than only the file you recently edited:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo nginx -TThe dump shows every included server block. Check for accidental files in conf.d or sites-enabled, old virtual hosts, and conflicting address-specific listeners.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Fix error 98: address already in use
Stop the service that should not own 443
If the listener is Apache, another reverse proxy, a development server or an old Nginx process, stop it using its service manager. For example:
sudo systemctl stop apache2
sudo systemctl disable apache2Use the actual unit name reported by ss, lsof or systemctl status; do not blindly disable a service you have not identified. If the process is managed by a container or supervisor, stop it through that manager so it does not immediately respawn.
Move the application and proxy to it
Often the other service is supposed to keep running. Change that application’s host binding to an unused port such as 8443 or 8080, then configure Nginx to accept public HTTPS traffic on 443 and proxy internally. The exact application setting varies, but the arrangement is:
Recommended Free Tools
- Nginx owns the public socket on
443. - The application listens on an unoccupied loopback or private-network port.
- Nginx’s
proxy_passpoints to that internal endpoint.
After changing a container publication, recreate or restart the container with a different host port. Changing only the container’s internal port does not free host port 443 if the old publication remains.
Remove a duplicate Nginx instance safely
If ps shows multiple masters, determine which one is managed by systemd and which configuration each uses. Stop the manually launched instance gracefully, then verify that 443 is free before starting the managed service:
sudo nginx -s quit
sudo ss -tlnp | grep ':443'
sudo systemctl start nginxIf the PID file is stale or the signal targets the wrong installation, use the master PID shown by ps and stop that process through its own init script or service definition. Avoid kill -9 unless a graceful stop fails and you understand the consequences.
Check IPv4 and IPv6 separately
A service listening on IPv6 may conflict with an Nginx listen [::]:443 directive even when IPv4 appears free. Conversely, a process bound only to one address may leave another address available. Compare the exact address in the error with every line returned by ss, and make the listeners intentional rather than deleting an IPv6 directive at random.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Fix error 13: permission denied
Understand privileged ports
On Linux, ports below 1024 are privileged. A non-root process normally cannot bind 443. Standard Nginx deployments start a root-owned master process, which opens the listening socket and then launches worker processes as the configured unprivileged user. If Nginx was started directly as an ordinary user, the bind fails before workers are created.
Check the service definition and the effective user:
systemctl cat nginx
ps -o user,pid,ppid,cmd -C nginxDo not confuse the worker user with the master user. A worker running as www-data or nginx is normal; the master must have the privilege needed to open 443.
Start the master through the service manager
Use the distribution’s service unit so the master starts with the expected privileges and configuration:
sudo systemctl start nginx
sudo systemctl enable nginxIf the unit has been customized with a non-root User= or an unusual wrapper, restore a correct service definition or adjust it only after understanding why the override exists. Validate the unit and configuration before enabling it at boot.
Grant only the bind capability when root is not desired
On systems where a non-root Nginx master is deliberate, Linux can grant the executable the CAP_NET_BIND_SERVICE capability:
sudo setcap 'cap_net_bind_service=+ep' /usr/sbin/nginxThe path differs by distribution; find the actual binary with command -v nginx or the executable path shown by the service. File capabilities can be removed or lost when the package is upgraded, and they change the security model of the binary. Recheck the capability after upgrades and restrict ownership and write access to the executable.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Use a high host port in rootless containers
Rootless Docker or Podman commonly cannot publish a privileged host port. Publish a host port above 1024, such as 8443, or run a separately privileged front-end that owns 443 and forwards traffic to the container. Changing the application to listen on 443 inside the container does not by itself grant permission to publish host port 443.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCheck SELinux and AppArmor denials
A process can have the Unix permissions it needs and still receive error 13 from a mandatory access-control policy. On SELinux systems, inspect the audit log for a denial involving Nginx and verify that the port is labeled for web-server use. On AppArmor systems, inspect the profile status and kernel or system logs for a denied bind operation. Policy commands and labels vary by distribution, so apply the documented rule for that platform rather than disabling the protection globally. If no denial is logged, return to the process user and service-unit checks instead of changing policy.
Configure HTTPS correctly on modern Nginx
Use the ssl listen parameter
HTTPS belongs on a server block with a directive such as:
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/nginx/certs/example.com.fullchain.pem;
ssl_certificate_key /etc/nginx/certs/example.com.key;
}The old standalone ssl on; directive became obsolete in Nginx 1.15.0 and was removed in Nginx 1.25.1. On current releases, put ssl on the relevant listen directive instead. Leaving ssl on; in a configuration can produce an unknown-directive error even after the port conflict is fixed.
Keep certificate and key paths readable by the master
A certificate-path problem normally produces a different startup error, but it is efficient to check it after the bind issue is resolved. Confirm that the files exist, the key is protected, and the Nginx master can read them. Since Nginx 1.11.0, ssl_certificate may be specified more than once to load certificates of different types, such as RSA and ECDSA; each certificate still needs a matching private key and a valid chain.
Be careful with shared-port parameters
Multiple server blocks can share 443, but socket-level listen parameters affect the socket as a whole. A parameter placed on one block can therefore influence other blocks sharing that address and port. Keep the 443 listener definitions consistent, and avoid mixing incompatible options across duplicate blocks. If behavior changes after adding a new virtual host, inspect the complete output of nginx -T rather than only that host’s file.
Validate and restart in the right order
- Correct the identified port owner, privilege, container publication or security-policy issue.
- Run the configuration test:
sudo nginx -tProceed only when it reports that the syntax is okay and the test is successful. A successful syntax test does not prove that another process has released 443, so check the listener again when the original error was error 98.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Restart Nginx:
sudo systemctl restart nginx- Confirm the service and socket:
sudo systemctl status nginx --no-pager
sudo ss -tlnp | grep ':443'- Review recent journal entries if startup still fails:
sudo journalctl -u nginx -b --no-pager -n 100If Nginx starts but clients cannot connect, the bind problem is solved and the next investigation is different: firewall rules, DNS, certificate validity, upstream availability or an incorrect server name.
Common scenarios and the correct branch
Another web server is already the TLS endpoint
Choose one public TLS endpoint. Either leave the existing server on 443 and do not configure Nginx there, or move the existing server and let Nginx terminate HTTPS. Running both on the same address and port is not possible.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →A container was recreated with the same publication
Stop the old container, remove the stale publication and recreate it with a free host port. Verify the result with docker ps or podman ps and ss; editing a compose file without recreating the container leaves the old socket in place.
The service fails only after a reboot
This usually indicates startup ordering or an automatically launched competing service. Check both unit enablement and boot-time container definitions. Ensure the intended owner of 443 starts first and that the other service is moved, disabled or configured to wait for the proxy.
Nginx works on 8443 but not 443
This strongly points to privileged-port permission or mandatory-access-control restrictions rather than a certificate problem. Compare the service’s user and security profile, then either run the master with the required privilege, grant the narrowly scoped capability, or keep the high port behind a privileged front-end.
Prevention checklist
- Document which service owns host port 443 and whether it is a systemd service, container or control-panel component.
- Use one authoritative Nginx configuration and remove disabled or obsolete files from included directories.
- Keep HTTPS listeners in the modern
listen 443 ssl;form; remove obsoletessl on;directives before upgrading beyond Nginx 1.25.0. - Test with
sudo nginx -tbefore every reload or restart. - After package upgrades, verify file capabilities if you rely on
setcap. - Monitor service logs after boot so a competing listener is detected before users report an outage.
The Bottom Line
Error 98 requires freeing or relocating the process that already owns 443. Error 13 requires correcting the bind privilege or security policy. Once the underlying condition is fixed, run sudo nginx -t, restart Nginx, and verify that the intended process is listening on port 443.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
