block port 10443

See the help section on "Use local-in policies to close open ports or restrict access".

If PCI scan found some kind of SSL vulnerability at 10443, likely the public-facing interface is used GUI admin access with port 10443, or SSL VPN is configured with port 10443. The admin access at the internet interface is not recommended and you should disable it on the interface. But if you're using SSL VPN, instead of shutting it down, you need to address the SSL vulnerability the scan is warning. If not using, you can shut it down on the "ssl.root" interface; "set status down".

Just run a

config global

diag sys tcpsock | grep 0.0.0.0

if the port is in listening mode it will show in above output

after that just create a new policy

config firewall local-in-policy

edit 1

and then fill the required fields