When Nmap does service version detection with
-sV, it tries to match output from the service to a fingerprint in the
nmap-service-probes file. If there is no match (often because there is no output), then the name of the service is pulled from the
nmap-services file based on the port number, and a
? is appended to indicate that this is not a confident result. Port 443 is listed as "https" in
In the process of service fingerprinting, sometimes the service is detected as SSL/TLS. In this case, the "service tunnel" is labeled
ssl and the service fingerprinting process starts over inside the encrypted tunnel. If you see
ssl/https? then it means that Nmap knows it's running some SSL-encrypted service, but it doesn't know what the service is, other than that it's running on port 443.
You should always use the latest version of Nmap to ensure that you have the latest updates to
nmap-service-probes. If you see a service that Nmap doesn't know yet, you can submit it.