3663546 - SCC handshake failed: 401 — Unauthorized while refreshing a cloud foundry subaccount certificate from SCC

While refreshing the certificate of a Cloud Foundry subaccount from SCC, following is perceived from SCC trace (ljs_trace.log / scc_core.trc):

=====
20xx-xx-xx xx:xx:xx,xxx +0000#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-14#          #https://connectivitycertsigning.cf.us10.hana.ondemand.com:443/certificate/management/v1/sign/account/<subaccount -ID> Returned Http Response with code 401
20xx-xx-xx xx:xx:xx,xxx +0000#DEBUG#org.apache.http.impl.conn.PoolingHttpClientConnectionManager#https-jsse-nio2-8443-exec-14#          #Connection manager is shutting down
20xx-xx-xx xx:xx:xx,xxx +0000#DEBUG#org.apache.http.impl.conn.DefaultManagedHttpClientConnection#https-jsse-nio2-8443-exec-14#          #http-outgoing-148344: Close connection
20xx-xx-xx xx:xx:xx,xxx +0000#INFO#com.sap.scc.tomcat.utils.SystemPrintStreamSSLWrapper#https-jsse-nio2-8443-exec-14#          #javax.net.ssl|FINE|04 1E|https-jsse-nio2-8443-exec-14|20xx-xx-xx xx:xx:xx.xxx UTC|SSLSocketImpl.java:497|duplex close of SSLSocket
20xx-xx-xx xx:xx:xx,xxx +0000#INFO#com.sap.scc.tomcat.utils.SystemPrintStreamSSLWrapper#https-jsse-nio2-8443-exec-14#          #javax.net.ssl|FINE|04 1E|https-jsse-nio2-8443-exec-14|20xx-xx-xx xx:xx:xx.xxx UTC|SSLSocketImpl.java:1570|close the SSL connection (passive)
20xx-xxx-xx xx:xx:xx,xxx +0000#DEBUG#org.apache.http.impl.conn.PoolingHttpClientConnectionManager#https-jsse-nio2-8443-exec-14#          #Connection manager shut down
20xx-xx-xx xx:xx:xx,xxx +0000#INFO#com.sap.scc#https-jsse-nio2-8443-exec-14#          #An error occurred when trying to connect. See 'Log And Trace Files' and in particular ljs_trace.log for details. Associated entries were logged on or around 20xx-xx-xx xx:xx:xx,xxx +0000.
com.sap.scc.servlets.RequestFailureExecution$InvalidConfiguration: An error occurred when trying to connect. See 'Log And Trace Files' and in particular ljs_trace.log for details. Associated entries were logged on or around 20xx-xx-xx xx:xx:xx,xxx +0000.
    at com.sap.scc.servlets.ConfigurationServlet.refreshCertificate(ConfigurationServlet.java:1539)
    at com.sap.scc.servlets.ConfigurationServlet.dispatch(ConfigurationServlet.java:364)
    at com.sap.scc.servlets.ServletUtilities.service(ServletUtilities.java:58)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:583)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:212)

Caused by: com.sap.scc.servlets.CriticalSccException: Preparation of tunnel certificate for <Subaccount-ID>@cf.us10.hana.ondemand.com account failed due to unknown exception.
    at com.sap.scc.ui.SubaccountControl.applyConfig(SubaccountControl.java:225)
    at com.sap.scc.ui.SubaccountControl.refreshSubaccount(SubaccountControl.java:282)
    at com.sap.scc.servlets.ConfigurationServlet.refreshCertificate(ConfigurationServlet.java:1530)
    ... 39 common frames omitted
Caused by: com.sap.scc.servlets.SccHandshakeException: SCC handshake failed: 401 — Unauthorized
=====

• SAP Cloud Connector(SCC) release independent;
• SAP Business Technology Platform(BTP).

SAP Cloud connector, SCC, CC, connector, JVM, certificate, cert, refresh, subaccount, sub-account, sub account, tenant, ConfigurationServlet.refreshCertificate, handshake, cloud foundry, SCC, Cloud Connector, Authorization, handshake, unauthorized, code 401, error, HTTP, HTTPs, certificate renew manage subaccount, subaccount certificate, an error occurred when trying to connect, 417 an authorization problem occurred, unable to add a cloud foundry subaccount, subaccount (sac) in sap cloud connector,sap cloud platform, /certificate/management/v1/sign/account/ , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , BC-CP-CF , Cloud Foundry , Problem