IllegalAccessError for sun.net.www.protocol.http When Using OIDC Over TLS/SSL With JDK 17 in CA Access Gateway (SPS)

Products

• SITEMINDER
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign-On

Issue/Introduction

After upgrading CA Access Gateway (SPS) from 12.8 SP7 to 12.9, the SPS throws the following error when attempting to reach an OIDC endpoint over TLS/SSL:

Jun 11, 2026 7:00:11 PM org.apache.catalina.core.StandardWrapperValve invoke
SEVERE: Servlet.service() for servlet [bctokencontroller] in context with path [/affwebservices] threw exception [Servlet execution threw an exception] with root cause java.lang.IllegalAccessError: class com.netegrity.srca.connection.SSLHandler (in unnamed module @0x29b00f1b) cannot access class
sun.net.www.protocol.http.HttpURLConnection (in module java.base) because module
java.base does not export sun.net.www.protocol.http to unnamed module @0x29b00f1b
    at com.netegrity.srca.connection.SSLHandler.startSession(Unknown Source)
    at com.netegrity.srca.Srca.invoke(Unknown Source)
    ...

This error happens after having configured an Authentication Scheme that integrate IDSP. The CA Access Gateway (SPS) reaches IDSP using a proxy.

Environment

• Product: CA Access Gateway (SPS) 12.9 (upgraded from 12.8 SP7)
• JDK: 17
• Trigger: SPS reaching an OIDC endpoint over TLS/SSL

Cause

JDK 17 enforces the Java Platform Module System (JPMS) introduced in Java 9.

The internal package sun.net.www.protocol.http is no longer exported by the java.base module to unnamed modules by default.

The SSLHandler class in SPS 12.9 relies on direct access to this internal JDK class, which is blocked under JDK 17 without an explicit export directive (1).

Resolution

Permanent fix: Upgrade CA Access Gateway (SPS) to 12.9 SP1 (12.9.1) or later once that version becomes available.

Workaround for CA Access Gateway (SPS) 12.9:

Add the following JVM argument to proxyserver.sh:

SPS_TOMCAT_OPTS="$SPS_TOMCAT_OPTS --add-exports=java.base/sun.net.www.protocol.http=ALL-UNNAMED"

Steps:

1. Open <SPS_HOME>/proxy-engine/conf/proxyserver.sh in a text editor.
2. Locate the SPS_TOMCAT_OPTS section.
3. Add the --add-exports flag with the value as shown above.
4. Save the file and restart the CA Access Gateway (SPS) service.

Additional Information

1. 7 Migrating From JDK 8 to Later JDK Releases