3542719 - "java.security.cert.CertPathValidatorException: signature check failed" during XSA installation

When attempting to install Extended Application Services Advanced (XSA) the following exception is encountered in hdblcm:

02:14:39.122 - INFO:     Output line 1: SAP HANA XS RUNTIME installation kit detected.
02:14:39.518 - INFO:     Output line 2: 
02:14:39.518 - INFO:     Output line 3: 
02:14:39.518 - INFO:     Output line 4: SAP HANA Lifecycle Management - SAP XS RUNTIME Installation <version>
02:14:39.518 - INFO:     Output line 5: ******************************************************************************
...
02:26:10.915 - INFO:     Output line 72:   [03] Starting step: Verify the XSA default domain and API endpoint
02:26:11.563 - INFO:     Output line 73: Installation failed
02:26:11.563 - INFO:     Output line 74:   error installing
02:26:11.564 - INFO:     Output line 75:     Cannot install
02:26:11.564 - INFO:     Output line 76:       Custom event postInstall failed
02:26:11.564 - INFO:     Output line 77:         Update content of XS Advanced Runtime failed
...
02:26:11.565 - INFO:     Output line 99:             Output line 20: [03] Starting step: Verify the XSA default domain and API endpoint
02:26:11.565 - INFO:     Output line 100:             Output line 21: [03] ERROR: 
02:26:11.565 - INFO:     Output line 101:             Output line 22: [03] com.sap.xs2rt.installation.util.InstallationException: Failed to check controller version
02:26:11.565 - INFO:     Output line 102:             Output line 23: [03]     at com.sap.xs2rt.installation.impl.hana.content.CheckDefaultDomain.install(CheckDefaultDomain.java:69)
02:26:11.565 - INFO:     Output line 103:             Output line 24: [03]     at com.sap.xs2rt.installation.steps.InstallationStep.installAndMeasure(InstallationStep.java:150)
02:26:11.565 - INFO:     Output line 104:             Output line 25: [03]     at com.sap.xs2rt.installation.procedures.InstallationProcedure.executeStep(InstallationProcedure.java:148)
02:26:11.565 - INFO:     Output line 105:             Output line 26: [03]     at com.sap.xs2rt.installation.procedures.InstallationProcedure.perform(InstallationProcedure.java:246)
02:26:11.565 - INFO:     Output line 106:             Output line 27: [03]     at com.sap.xs2rt.installation.impl.hana.content.HanaContentInstallUpdateProcedure.main(HanaContentInstallUpdateProcedure.java:122)
02:26:11.565 - INFO:     Output line 107:             Output line 28: [03] Caused by: com.sap.xs2rt.core.installation.exceptions.InstExceptionBase: FAILED to connect to the controller on API endpoint https://<default_domain>:3<NR>33: Please check and renew the default domain certificate. Cause: Could not get controller info: Error executing request GET https://<default_domain>:3<NR>33/v2/info: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed

• SAP HANA, platform edition
• SAP HANA XS Advanced Model (XSA)

KBA , BC-XS-RT , XS Advanced Runtime / XS Controller , HAN-LM-INS-DB , Installation of HANA Database , Problem