netstat says 443 is open, but I cannot connect to it with telnet .. why ?

Answer 1

Telnet cannot be used to comunicate with encrited webs.

Checkout this microsfot note. It says "NOTE: This example assumes that the Web server is configured to use the default HTTP port (TCP 80). If the Web server is listening on a different port, substitute that port number in the first line of the example. Also, this example does not work properly over an HTTPS/SSL connection (TCP 443, by default), because the telnet client cannot negotiate the necessary encryption commands to establish the SSL session. Although an initial connection is possible over the HTTPS/SSL port, no data is returned when you issue a GET request."

Update: Checkout this other note HOW TO: Determine If SSL Connectivity Is Not Working on the Web Server or on an Intermediate Device

Answer 2

As FerrariB said, telnet does not perform the negotiations necessary to open an SSL connection. Telnet knows nothing about certificates, nor encryption. Thus, you are guaranteed to not be able to communicate with HTTPS port 443 via telnet. You will have to find another way to do whatever you are trying to do.

Check out the Wikipedia page on TLS for example, where it says directly:

If any one of the above steps fails, the TLS handshake fails, and the connection is not created.

This is precisely what you are seeing by trying to use telnet to communicate with an SSL endpoint.

Answer 3

The telnet client is not going to know to send a properly constructed request to initiate an https handshake, so I imagine the ssl secured server is just waiting for more data.

The telnet client is certainly not going to know what to do with the response from a ssl secured server (it's certainly not going to prompt you for data to send along). Communication can only happen once the https handshake has completed.

You need to use a client that knows how to do a handshake. The openssl binary can do this out of the box.