Error 404 accessing backend pages through Access Gateway

Products

• SITEMINDER

Issue/Introduction

Ever since the Policy Server and Access gateway have been upgraded to SiteMinder version 12.9, previously working applications at the backend server come up with error 404

In the Access Gateway http client logs one can see:

2026-06-09 16:11:36,365 DEBUG [org.apache.hc.client5.http.headers] http-outgoing-11 >> Accept-Encoding: gzip, x-gzip, deflate
2026-06-09 16:11:36,365 DEBUG [org.apache.hc.client5.http.headers] http-outgoing-11 >> Host: server.example.com:80
2026-06-09 16:11:36,365 DEBUG [org.apache.hc.client5.http.headers] http-outgoing-11 >> Upgrade: TLS/1.2

and....

2026-06-09 16:11:36,374 DEBUG [org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager] ep-0000000031 connection released [route: {}->[http://server.example.com:80]][total available: 7; route allocated: 2 of 420; total allocated: 9 of 420]

Now unfortunately this added port breaks the logic according to how this application works:

2026-06-09 16:11:36,366 DEBUG [org.apache.hc.client5.http.wire] http-outgoing-11 >> "Host: server.example.com:80[\r][\n]"

2026-06-09 16:11:36,366 DEBUG [org.apache.hc.client5.http.wire] http-outgoing-11 >> "Upgrade: TLS/1.2[\r][\n]"

2026-06-09 16:11:36,366 DEBUG [org.apache.hc.client5.http.wire] http-outgoing-11 >> "Connection: Upgrade[\r][\n]"

 2026-06-09 16:11:36,366 DEBUG [org.apache.hc.client5.http.wire] http-outgoing-11 >> "[\r][\n]"

 2026-06-09 16:11:36,373 DEBUG [org.apache.hc.client5.http.wire] http-outgoing-11 << "HTTP/1.1 404 Not Found[\r][\n]"

 

It may be noticed that port 80 (or 443 if connection is ssl) is appended to the host header name

Environment

CA SiteMinder 12.9 

Cause

SiteMinder 12.9 uses Apache HttpClient 5.x, which automatically appends the port number to the Host header (e.g., backend.example.com:443).

If the backend server or application performs a strict string comparison on the Host header and does not expect the port suffix, it terminates the connection with error 404.

Resolution

The recommended path is to relax the rules on host header matching at the backend server to allow for the port to be appended to the host without breaking the logic of the backend application.

If for some reason such solution is not possible, please open a case with Broadcom Support to explore possible options

Additional Information

Please see

https://broadcomcms-software.wolkenservicedesk.com/external/article?articleNumber=421739

for a list of http client 5.X settings available in SiteMinder 12.9