3649446 - Timeout while adding a subaccount to SCC hosted within SAP ECS/HEC infrastructure

While adding a new subaccount to an SCC (which is running within SAP ECS/HEC infrastructure) it fails, and upon checking SCC trace, you perceive following or similar entries from its trace (ljs_trace.log / scc_core.trc).

=====
2025-08-27 20:34:10,097 +0000#INFO#com.sap.scc#https-jsse-nio2-8443-exec-8#          #Failed to sign the Cloud Connector certificate for subaccount <subaccount ID>@cf.us21.hana.ondemand.com. Verify configuration and proxy settings. See 'Log And Trace Files' and in particular scc_core.trc for details. Associated entries were logged on or around 2025-08-27 20:34:10,096 +0000. Consult SAP note 2460641 for possible remedies.
com.sap.scc.servlets.RequestFailureExecution$InvalidConfiguration: Failed to sign the Cloud Connector certificate for subaccount <subaccount ID>@<region>.hana.ondemand.com. Verify configuration and proxy settings. See 'Log And Trace Files' and in particular scc_core.trc for details. Associated entries were logged on or around 2025-08-27 20:34:10,096 +0000. Consult SAP note 2460641 for possible remedies.
    at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:152)
    at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1519)
...
..
..
Caused by: com.sap.scc.servlets.CriticalSccException: Preparation of tunnel certificate for <subaccount ID>@<region>.hana.ondemand.com account failed.
    at com.sap.scc.ui.SubaccountControl.applyConfig(SubaccountControl.java:244)
    at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:128)
    ... 40 common frames omitted
Caused by: org.apache.http.conn.ConnectTimeoutException: Connect to connectivitycertsigning.cf.us21.hana.ondemand.com:443
Caused by: java.net.SocketTimeoutException: connect timed out (local port <local port> to address <SCC IP addrss> (<local hostname>), remote port 443 to address <BTP region IP address>)
    at java.net.PlainSocketImpl.socketConnect(Native Method)
    at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:476)
    at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:218)
=====


Note: Image/data in this KBA is from SAP internal systems, sample data, or demo systems, and any resemblance to real data is purely coincidental.

• SAP Cloud Connector (SCC) release independent;
• SAP ECS/HEC infrastrucure;
• Proxy server.

SAP Cloud connector, SCC, SAP CC, connector, cloud connector, sub-account, sub account, account, subaccount, tenant, proxy, timeout, time-out, time out, timed out, network, firewall, router, region, BTP, Business Technology Platform, hana.ondemand.com, .hana.ondemand.com, SAP ECS, SAP HEC, HEC, ECS, connectivitycertsigning, connectivitynotification, proxy, 3128, org.apache.http.conn.ConnectTimeoutException , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem