3391743 - PKIX path building: unable to find valid certification path to requested target while adding/refreshing BTP sub-account from SCC leading to TLS termination

While renewing/adding a BTP sub-account on SCC, it fails and following error is raised from SCC trace file (ljs_trace.log / scc_core.trc):

Following error (or similar) will appear while selecting the sub-account from SCC WebUI interface:


   

Note: This particular error may also arise suddenly, even though nothing has been changed from either BTP cloud environment or SCC.

• SAP Cloud Connector release independent;
• SAP BTP Cloud environment;
• Possibly a firewall intercepting the connection.

certificate, refresh, renew, firewall, router, PKIX, digicert, issuer, SCC, 2.16.0, 2.15.0, 2.15.1, 2.15.2, 2.14.2, 2.14.1. 2.14.0, 2.13.0, 2.12, 2.10, sub-account, subaccount, cloud foundry, Neo, BTP, connection, SSL Engine, SSLEngine, WebUI, Web UI, Issuer, Subject DN, firewall, router, certificate, sign, signed, signing, TLS, TLS-termination, TLS termination, SSL, inspection, DigiCert Global, root CA, CA, hana.ondemand.com, ondemand.com, Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem