3017609 - "Reject untrusted forwarded certificate" in Principal Propagation scenarios

Principal propagation is configured between Business Technology Platform, Cloud Connector and a backend on-premise system such as ABAP or S/4HANA. Connection is either direct between the Cloud Connector and ABAP or S/4HANA, or there is an additional intermediary such as a reverse proxy, SAP Web Dispatcher or a Load balancer between the Cloud Connector and the backend system.

Principal Propagation is failing with the following errors seen in the dev_icm trace of the backend ABAP or S/4HANA system:
HttpCertIsReverseProxyTrustworthy: no trust relationship to intermediary specified (see documentation for parameter "icm/HTTPS/trust_client_with_issuer" or "icm/trusted_reverse_proxy")
HttpIsReverseProxyTrustworthy: intermediary is NOT trusted
HttpModGetDefRules: intermediary is NOT trusted -> remove SSL header fields
Reject untrusted forwarded certificate

Additionally the following might be seen:
(received via HTTPS with untrusted certificate) or (received via HTTP) or (received via HTTPS without certificate)

In case no certificate is received/trusted by the backend, and SAML2 is configured, the following error may be seen:
"https://<IDP hostname> refused to connect"

Context of the Trace (dev_wdisp)

Component: SAP ICM (Web Dispatcher / ICM HTTPS listener)
Protocol: HTTPS (TLS)
Role: Server
Client: AWS ELB Health Checker (ELB-HealthChecker/2.0)
Client certificate: Requested but not provided

SSL Session Initialization
SapSSLSessionInit()
role=SERVER, auth_type=ASK_CLIENT_CERT

Network Connection (NI Handle)
local=......
peer=...... (ELB)

Client Certificate Handling
NO client cert
Client certificate info: no certificate received

IcmNormalizeCertificateSubject: Unexpected subject/issuer cannot be normalized — occurs when SCC certificate's O= field contains RFC 4514 special characters (embedded comma or double-quotes). Full-DN matching in icm/trusted_reverse_proxy_0 fails even after correct configuration 

Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental.

• SAP NetWeaver release independent;
• SAP Business Technology Platform Connectivity;
• SAP Cloud Connector(SCC) release independent.

intermediary is NOT trusted, SCC, SAP Cloud Connector, backend, principal propagation, ABAP, S4HANA, Reject untrusted forwarded certificate (received via HTTPS with untrusted certificate), BTP, Business Technology Platform, reverse proxy did not forward a certificate, HttpIsReverseProxyTrustworthy: intermediary is NOT trusted, HttpIsReverseProxyTrustworthy, does not match trusted subject, Principal propagation, PP, principal, $name, $email, $mail, $display_name, $login_name,  trust_client_with, CERTULE, SSL Server Standard, CA, Certificate Authority, subject pattern, PP, trusted_reverse_proxy, trust_client_with_issuer, trust_client_with_subject,  PKIX, certificate path, certificate, sample, subject pattern, assertion, SAML, SAML2, BTP, Subject DN, Issuer, SAN, Subject, subject alternative name, popup, username, Assertion ticket, does not match trusted issuer , KBA , BC-CST-IC , Internet Communication Manager , BC-CST-WDP , Web Dispatcher , BC-SEC-LGN , Authentication , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem