3457237 - SAP Cloud Connector - Add DataSphere Subaccount got SCC handshake failed: 403 — Forbidden Error

When adding a DataSphere Subaccount to the cloud connector, The below Error shows in the ljs_trace.log or scc_core.trc (version 2.17.0)

#INFO#com.sap.scc#https-jsse-nio2-8443-exec-2#          #An authorization problem occurred when downloading the configuration. Ensure that the subaccount exists and that the user has the appropriate permissions for the subaccount. See 'Log And Trace Files' and in particular ljs_trace.log for details. Associated entries were logged on or around Consult SAP note 2697152 for possible remedies.
com.sap.scc.servlets.RequestFailureExecution$InvalidConfiguration: An authorization problem occurred when downloading the configuration. Ensure that the subaccount exists and that the user has the appropriate permissions for the subaccount. See 'Log And Trace Files' and in particular ljs_trace.log for details. Associated entries were logged on or around Consult SAP note 2697152 for possible remedies.
    at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:120)
    at java.lang.Thread.run(Thread.java:838)
Caused by: com.sap.scc.servlets.CriticalSccException: Preparation of tunnel certificate for xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx@cf.euxx.hana.ondemand.com account failed due to unknown exception.
    at com.sap.scc.ui.SubaccountControl.applyConfig(SubaccountControl.java:225)
    at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:115)
    ... 40 common frames omitted
Caused by: com.sap.scc.servlets.SccHandshakeException: SCC handshake failed: 403 — Forbidden
    at com.sap.scc.cert.HttpCertificateManagementService.processRequest(HttpCertificateManagementService.java:143)
    at com.sap.scc.cert.HttpCertificateManagementService.executePostRequest(HttpCertificateManagementService.java:120)
    at com.sap.scc.cert.HttpCertificateManagementService.signCertificateForSCC(HttpCertificateManagementService.java:79)
    at com.sap.scc.ui.SubaccountControl.applyConfig(SubaccountControl.java:18

Cloud connector 2.15.2 - 2.17.0.

Cloud connector, SCC, DataSphere, Subaccount, HTTP 403 , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , DS-DI-CON , Connections , Problem