Rainer, I tried mod_jk 1.2.38-dev and it works as expected : An HTTPd in front, 2 Nexus behind, using HENRICOOKIE, requests are sent to proper Tomcat whatever Nexus/Shiro did with JSESSIONID ie :
Browser 1 : HENRICOOKIE .swf-nexus JSESSIONID 799c3a8a-fd70-4a08-8a1a-6f301da6a9bc Browser 2 : HENRICOOKIE .swf-nexus2 JSESSIONID 29f23c5e-de2d-46e6-82cd-544e9d406699 It seems a good workaround for my problem and I guess for many others. Thanks Rainer !