So I've just taken delivery of a new 2860 and set it up, all working well, however, I discovered that port 443 is OPEN when performing the 'Shields Up' port probe test at grc.com
I do not have remote management turned on.
Port 443 being open is a bit of a security risk. Am I missing something in the menus that has 443 TLS open by default?

Hmm, look in your firewall settings , are the attack protection settings set to on ?

Enable DoS defence is on with everything ticked.

SSL VPN?

ChrisW wrote: SSL VPN?

I tried unticking WAN1 to WAN4 but it seems at least one needs to be enabled as I get the following error "Choose a WAN interface at least!"

Not sure where you are seeing that message. Do you have any VPN's enabled (using main menu on left of screen)?