SAP Knowledge Base Article - Preview

3703230 - Tunnel connection error due to SSL handshake failure between Cloud Connector and SAP BTP after BTP root certificate replacement

Symptom

Starting from January 2026, customers observe tunnel connection error to subaccounts on BTP Cloud Foundry from Cloud Connector. Various cloud applications can be affected.

The following error messages can be found in scc_core.trc/ljs_trace.log traces on Cloud Connector:

  • "Unexpected exception while establishing tunnel connection for tunnel: account:///xxxxxx javax.net.ssl.SSLException: SSLEngine closed already".
  • "java.util.concurrent.ExecutionException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target".


Read more...

Environment

SAP Cloud Connector
BTP Cloud Foundry

Product

SAP Business Technology Platform all versions ; SAP Connectivity service all versions

Keywords

SSL handshake failure, SAP Cloud Connector, BTP subaccount, SAP BTP, G5 root certificate, DigiCert TLS RSA4096 Root G5, SAPJVM, connectivity error, tunnel connection failure, Cloud Foundry, outdated JDK version, PKIX path building failed, unable to find valid certification path to requested target. , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.