3703692 - SAP Cloud Connector – BTP to On-Premise Connectivity Fails on Older SCC and SAP JVM Versions

In SAP BTP to on-premise integration scenarios (for example: SAC, DI, DS, BAS, CPI, DMC, Fiori Launchpad, Work Zone, SAP Mobile Services), the connection to the on-premise system fails when using an older version of SAP Cloud Connector (SCC) running on an outdated SAP JVM.

The connection failure occurs during SSL/TLS handshake.

The following error can be found in scc_core.trc or ljs_trace.log on the Cloud Connector host:

2024-10-27 05:42:19,146 -0400#WARN#io.netty.util.concurrent.DefaultPromise#tunnel-client-11-4#          #An exception was thrown by com.sap.core.connectivity.spi.ssl.SSLHandshakeValidator.operationComplete()
java.util.concurrent.ExecutionException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at io.netty.util.concurrent.DefaultPromise.get(DefaultPromise.java:351)
    at com.sap.core.connectivity.spi.ssl.SSLHandshakeValidator.operationComplete(SSLHandshakeValidator.java:36)

SAP Cloud Connector version older than 2.16.2

JVM and JDK older than below list

• SAP JVM 8.1.097
• SapMachine 11.0.22 (SapMachine 11 is out of maintenance, though)
• SapMachine 17.0.10
• SapMachine 21.0.2
• Oracle JDK 8u401

Note: Since around May of last year, an alert has been displayed in all Cloud Connector versions newer than 2.12, notifying customers that an upgrade is required. 

G5 certificate, service unavailable, timed out, tunnel to open, cloud connector, SAP CPI, SAP Cloud Connector, SAP Integration Suite, endpoint failure, multicast processing, HTTPException, SAP BTP, subaccount connection failure, debug trace level, ljs_trace.log, scc_core.trc, scc_about.txt, subaccount overview, SAP CPI error , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem