Port 3529: JBoss IIOP/SSL — The CORBA Port That Time Forgot

What This Port Does

Port 3529 is the JBoss IIOP/SSL port — officially registered with IANA in June 2002 by Francisco Reverbel.¹

IIOP stands for Internet Inter-ORB Protocol. It is the wire protocol that lets CORBA (Common Object Request Broker Architecture) objects communicate across a network.² The SSL variant — SSLIOP — wraps that communication in TLS encryption. Port 3529 is where JBoss, the open-source Java application server, listens for those encrypted CORBA connections.

In practice, you are unlikely to encounter this port unless you are working with legacy JBoss deployments that expose CORBA interfaces to remote clients.

The Protocol Behind It

CORBA was the distributed computing vision of the 1990s: a world where a Java object on one machine could call a method on an object sitting on a machine across the planet, with the wire protocol invisible to the developer. GIOP (General Inter-ORB Protocol) was the message format; IIOP mapped it to TCP/IP.³

The standard IANA-assigned ports for CORBA are 683 (IIOP) and 684 (IIOP/SSL). JBoss used its own port assignments — 3528 for plain IIOP and 3529 for IIOP over SSL — registered separately when JBoss was gaining traction as a production application server.

REST and HTTP-based services made CORBA largely obsolete for new development. The protocol survives in long-lived enterprise systems, particularly in telecommunications and financial services where CORBA was deeply embedded before the web changed everything.

What Range This Port Belongs To

Port 3529 sits in the registered port range (1024–49151). IANA assigns ports in this range to specific services upon request — unlike the well-known ports below 1024, which are reserved for foundational protocols, or the ephemeral range above 49151, which operating systems assign dynamically to outgoing connections.

Registered ports require an application to have staked a claim. Someone asked for 3529, got it, and it's been in the registry ever since — used or not.

Security Considerations

Because IIOP/SSL traffic is encrypted and the protocol is uncommon, this port is unlikely to attract opportunistic scanners looking for easy targets. However:

• If you see port 3529 open on a system that has no JBoss deployment, investigate. It should not be open without a reason.
• Old JBoss IIOP deployments may use outdated TLS configurations. If you do run a CORBA service on this port, audit the cipher suites and certificate chain.
• CORBA itself has a complex security model. SSLIOP addresses transport-layer encryption but does not substitute for proper CORBA security policy configuration.⁴

How to Check What's Listening

To see if anything is using port 3529 on your system:

# Linux/macOS — show process listening on port 3529
ss -tlnp | grep 3529

# macOS alternative
lsof -i :3529

# Windows
netstat -ano | findstr :3529

If you see a Java process listening here, you almost certainly have a JBoss (or Red Hat JBoss EAP) server with IIOP/SSL enabled.