SAP Knowledge Base Article - Preview

3391743 - PKIX path building: unable to find valid certification path to requested target while adding/refreshing BTP sub-account from SCC leading to TLS termination

Symptom

While renewing/adding a BTP sub-account on SCC, it fails and following error is raised from SCC trace file (ljs_trace.log / scc_core.trc).


   2023-10-04 16:42:10,204 +0300#ERROR#com.sap.scc.ui#https-jsse-nio2-8443-exec-2#          #Error when checking connectivity by sending HEAD request to https://xxxxxxxxxxxxxxxxxxx.sa1.hana.ondemand.com -->    javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target   


Following error (or similar) will appear while selecting the sub-account from SCC WebUI interface.


   SSLEngine_error.png



PS: This particular error may also arise suddenly, even though nothing has been changed from either BTP cloud environment or SCC.


Read more...

Environment

  • SAP Cloud Connector release independent;
  • SAP BTP Cloud environment;
  • Possibly a firewall intercepting the connection.

Product

SAP Service Cloud all versions

Keywords

certificate, refresh, renew, firewall, router, PKIX, digicert, issuer, SCC, 2.16.0, 2.15.0, 2.15.1, 2.15.2, 2.14.2, 2.14.1. 2.14.0, 2.13.0, 2.12, 2.10, sub-account, subaccount, cloud foundry, Neo, BTP, connection, SSL Engine, SSLEngine, WebUI, Web UI, Issuer, Subject DN, firewall, router, certificate, sign, signed, signing, TLS, TLS-termination, TLS termination, SSL, inspection, DigiCert Global, root CA, CA, hana.ondemand.com, ondemand.com, , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.