DocumentationExperience Cloud KCS

AEM solution for 421 TLS SAN mismatch errors with customer-managed CDNs

Last update: July 22, 2026

HTTP 421 TLS SAN mismatch errors can occur when a customer-managed CDN, proxy, or WAF sends the wrong Host header or SNI value to the Adobe ingress domain for Adobe Experience Manager as a Cloud Service. In many cases, the request also fails because required forwarded headers are missing or incomplete. Updating the origin configuration so the CDN uses the Adobe ingress domain for Host and SNI, while forwarding the original site domain and any required authentication headers, usually resolves the issue.

Description description

Environment

Adobe Experience Manager as a Cloud Service

Issue/Symptoms

You may see this issue when a customer-managed CDN, WAF, proxy, or load balancer forwards a Host header or SNI value that does not match the Adobe ingress domain for the AEM publish origin.

  • The request fails before it reaches the publish tier and returns HTTP 421 Misdirected Request.
  • The response may state that the requested host does not match the certificate subject alternative names.
  • In some proxy-based deployments, you may instead see a message indicating that the Host does not match SNI.
  • You can confirm the issue by comparing the origin request settings with the Adobe ingress domain and testing the origin directly. A correctly formed request typically returns HTTP 200 or 301, while a mismatched Host or SNI value can return HTTP 421.

Resolution resolution

Try the following steps to solve the issue:

  1. Identify the Adobe ingress domain for the affected publish environment in Cloud Manager, and use the publish domain in the format publish-p<program>-e<environment>.adobeaemcloud.com as the origin target. This ensures that you are routing requests to the correct Adobe endpoint for the environment. Verify the value by testing the ingress domain directly and confirming that a correctly formed request returns an HTTP 200 or 301 response.
  2. Configure your CDN, proxy, or WAF to use the Adobe ingress domain as the origin SNI value. This allows the TLS handshake to use the certificate that matches the Adobe ingress domain. Verify the configuration in your CDN or proxy debug output and confirm that the SNI value matches the Adobe ingress domain exactly.
  3. Set the origin Host header to the same Adobe ingress domain. This helps the request match the certificate and routing target expected by Adobe-managed CDN infrastructure. Verify the change by retesting the request and confirming that the previous HTTP 421 SAN mismatch error no longer occurs because of a Host or certificate mismatch.
  4. Forward the original site domain in the X-Forwarded-Host header so that AEM can resolve the incoming domain correctly after the request reaches the origin. This ensures that host-based routing continues to work as expected for the customer-facing domain. Verify the behavior by confirming that the request resolves to the expected site or virtual host.
  5. If your setup uses customer-managed CDN authentication, configure and send the X-AEM-Edge-Key value defined for the environment in Cloud Manager. This allows Adobe-managed CDN services to recognize the request as trusted and process the forwarded headers correctly. Verify the configuration by confirming that the request no longer fails because of missing edge authentication.
  6. Retest the request end to end. If you use cURL for validation, target the Adobe ingress domain and include the required Host, X-Forwarded-Host, and, when required, X-AEM-Edge-Key headers. The expected result is that the request returns HTTP 200 or 301 instead of HTTP 421. Verify the outcome by confirming that both browser and cURL tests now route successfully to the expected site.

If the following symptoms occur and the troubleshooting steps produce the following results, submit a ticket to Adobe Support:

  • HTTP 421 continues after the origin domain, Host header, and SNI value all match the Adobe ingress domain.
  • The request still fails after you forward X-Forwarded-Host and, when required, a valid X-AEM-Edge-Key.
  • Your CDN, proxy, or WAF cannot override the Host header or SNI value for origin requests.

Open a case and include the exact error text, the affected domain, the Adobe ingress domain, sanitized test results, and any relevant CDN debug output.

recommendation-more-help
experience-cloud-kcs-help-kbarticles