Theory #1: Tomcat is overwhelmed. Now that I'm using 8443 as the port for distributing packages, the OS X web server is no longer serving them - Tomcat is. When I flush the log of problems, I'll get a rush of "package not successfully downloaded" errors in the log, and then a few will trickle in that succeeded.

I have about 600 clients, and this policy affects more than 500 of them.

Why are you using the Tomcat port?

The problem is that we have clients connecting from outside of our network, and we're not able to open :80 (but can open :8443).

What about still using Apache and using 443 instead?

Do you have a cert installed? Is it trusted by the clients?

Jared, I've reverted to using port 80 and the problem is resolved. Our rep agreed that using Tomcat was not recommended. We're still running 10.6 server, and the baked-in Apache version is considered vulnerable by our security team (though I believe it's a "medium" vulnerability). So, my options were to use Tomcat (which doesn't seem to work, but also doesn't show up on scans) or use Apache (works great, picked up on scans). It may just be time to move to 10.7 server.

Bentoms, yep - always have. The change was which web server (and port) were being used to serve the downloads.