Security & Firewall Penetration Read: 12 min read · Updated 2026-10-18

GitHub SSH vs. HTTPS Protocol Selection & Port 443 Penetration

💡 Executive Summary

Detailed comparison between Git SSH and HTTPS protocols under cross-border network constraints. Explains port 22 blocking, configuring SSH over port 443 via ssh.github.com, SSH config ProxyCommand, and optimizing protocol choice for developer workflows.

Table of Contents (4 sections)

1. Protocol Deep-Dive: SSH (Port 22) vs. HTTPS (Port 443)
2. Bypassing Port 22 Blocks: SSH over Port 443
3. Configuring SSH via ProxyCommand / Connect-Proxy
4. Architectural Recommendation: Protocol Strategy Matrix

1. Protocol Deep-Dive: SSH (Port 22) vs. HTTPS (Port 443)

When interacting with GitHub repositories, developers typically choose between two primary transport protocols:

Feature Dimension	Git over SSH (`[email protected]:...`)	Git over HTTPS (`https://github.com/...`)
Default Network Port	Standard TCP Port 22	Standard TCP Port 443 (TLS)
Authentication Method	Asymmetric Ed25519/RSA Public Keys	Personal Access Token (PAT) / OAuth
Corporate Firewall Evasion	❌ Port 22 is frequently blocked by corporate IT	✅ Port 443 is universally open for HTTPS web traffic
Proxy Gateway Acceleration	Difficult to route through web reverse proxies	✅ Native compatibility with streaming reverse proxies
Best-Fit Use Case	Private development & authenticated `git push`	High-speed cloning, Release assets & CI/CD automation

In corporate campus networks, enterprise firewalls often restrict outbound traffic strictly to standard web ports (80/443), dropping outbound connections on port 22.

2. Bypassing Port 22 Blocks: SSH over Port 443

GitHub officially operates an SSH listener on standard HTTPS port 443 via the hostname ssh.github.com. If your network blocks port 22, you can configure your SSH client to tunnel Git over port 443.

Edit your local ~/.ssh/config:

Host github.com
    Hostname ssh.github.com
    Port 443
    User git
    IdentityFile ~/.ssh/id_ed25519

Test connection status:

ssh -T -p 443 [email protected]
# Expected output:
# Hi username! You've successfully authenticated, but GitHub does not provide shell access.

3. Configuring SSH via ProxyCommand / Connect-Proxy

If your workstation requires an intermediary HTTP or SOCKS5 proxy to access external networks, configure SSH’s ProxyCommand:

Host github.com
    Hostname ssh.github.com
    Port 443
    User git
    # For SOCKS5 proxy running locally:
    ProxyCommand nc -X 5 -x 127.0.0.1:7890 %h %p
    # Or on Windows using connect.exe:
    # ProxyCommand connect -S 127.0.0.1:7890 %h %p

4. Architectural Recommendation: Protocol Strategy Matrix

For optimal productivity and security, adopt a split-protocol strategy:

[Developer Operations]
   │
   ├── Read-Only Operations (Clone, Fetch, Releases, CI/CD) ──> Use HTTPS via https://ghproxy.icu/
   │                                                            (Zero latency, 15x throughput)
   │
   └── Write Operations (Private Git Push, Commits) ──────────> Use SSH over Port 443 with Ed25519 Keys
                                                                (Zero password prompts, robust auth)

By leveraging ghproxy.icu for large, read-heavy clone operations and reserving SSH strictly for lightweight write transactions (git push origin main), developers achieve the ideal balance of speed, security, and stability.

Previous Article Git Submodule & Monorepo Recursive Cloning Acceleration Guide Next Article Self-Hosting a GitHub Proxy Relay: Enterprise & Personal Deployment Guide