3671642 - Error while adding a Cloud Foundry subaccount to SCC (An error occurred when trying to connect)

Upon adding a new Cloud Foundry subaccount to SCC, following is raised from SCC Web UI:

And following is perceived from SCC trace (ljs_trace.log):


====
20xx-xx-xx xx:xx:xx,xxx +0300#WARN#com.sap.scc.rt#https-jsse-nio2-8443-exec-9#          #request GET https://connectivitycertsigning.cf.sa31.hana.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccount-ID> HTTP/1.1 failed with SSL handshake error SSL handshake error: validation failure(sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target)
com.sap.scc.servlets.RequestFailureExecution$InvalidConfiguration: An error occurred when trying to connect. See 'Log And Trace Files' and in particular ljs_trace.log for details. Associated entries were logged on or around 20xx-xx-xx xx:xx:xx,xxx +0300.
    at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:120)
    at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1430)
    at com.sap.scc.servlets.ConfigurationServlet.dispatch(ConfigurationServlet.java:229)
    at com.sap.scc.servlets.ServletUtilities.service(ServletUtilities.java:55)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:583)

Caused by: com.sap.scc.servlets.CriticalSccException: Preparation of tunnel certificate for <subaccount-ID>@cf.sa31.hana.ondemand.com account failed.
    at com.sap.scc.ui.SubaccountControl.applyConfig(SubaccountControl.java:205)
    at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:115)
    ... 40 common frames omitted

Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alert.createSSLException(Alert.java:131)
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:377)

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:146)
====

• SAP Cloud Connector(SCC) release independent;
• SAP Business Technology Platform(BTP);

certificate, refresh, renew, firewall, router, PKIX, digicert, issuer, SCC, 2.16.0, 2.15.0, 2.15.1, 2.15.2, 2.14.2, 2.14.1. 2.14.0, 2.13.0, 2.12, 2.10, sub-account, subaccount, cloud foundry, Neo, BTP, connection, SSL Engine, SSLEngine, WebUI, Web UI, Issuer, Subject DN, firewall, router, certificate, sign, signed, signing, TLS, TLS-termination, TLS termination, SSL, inspection, DigiCert Global, root CA, CA, hana.ondemand.com, ondemand.com, Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target, sap cloud connector, connector, CC, SCC, HTTP 503, 503, unavailable, handle, outbound, managed gateway, Spend&Network , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , BC-CP-CON-CF , Cloud Foundry to On-premise Connectivity service , Problem