3722170 - Connection refused while adding a subaccount to SAP Cloud Connector

While adding a new subaccount to SCC, following error is raised from SCC trace (ljs_trace.log / scc_core.trc).

====
xxxx-xx-xx xx:xx:xx,xxx +0300#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-6#          #Executing Http Get request to https://connectivitycertsigning.cf.sa31.hana.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccount ID>
xxxx-xx-xx xx:xx:xx,xxx +0300#INFO#com.sap.core.connectivity.tunnel.client.sso.TrustConfigurationServiceImpl#https-jsse-nio2-8443-exec-6#          #Successfully deleted IDP configuration for tunnel id 'account:///<subaccount ID>'
xxxx-xx-xx xx:xx:xx,xxx +0300#ERROR#com.sap.scc#https-jsse-nio2-8443-exec-6#          #Connection to cf.sa31.hana.ondemand.com failed. Check the network configuration.
com.sap.scc.servlets.RequestFailureExecution$InvalidConfiguration: Connection to cf.sa31.hana.ondemand.com failed. Check the network configuration.
    at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:169)
    at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1627)

Caused by: com.sap.scc.servlets.FatalSccException: Preparation of tunnel certificate for <subaccount ID>@cf.sa31.hana.ondemand.com account failed - connection failure. (Network issue, maybe with proxy)
    at com.sap.scc.ui.SubaccountControl.connectSubaccountToCloud(SubaccountControl.java:269)
    at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:145)
    ... 40 common frames omitted
Caused by: org.apache.http.conn.HttpHostConnectException: Connect to connectivitycertsigning.cf.sa31.hana.ondemand.com:443 [connectivitycertsigning.cf.sa31.hana.ondemand.com/34.166.72.122] failed: Connection refused: connectivitycertsigning.cf.sa31.hana.ondemand.com/34.166.72.122:443
    at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:156)
    at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)
    at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)

Caused by: java.net.ConnectException: Connection refused: connectivitycertsigning.cf.sa31.hana.ondemand.com/34.166.72.122:443
    at java.base/sun.nio.ch.Net.pollConnect(Native Method)
    at java.base/sun.nio.ch.Net.pollConnectNow(Net.java:682)
====

• SAP Cloud Connector (SCC);
• Infrastructure network;
• Proxy server.

SAP Cloud connector, SCC, CC, cloud connector, connector, certificate, refresh, renew, add subaccount, subaccount, sub-account, account, sub account, tenant, expired, cert, hana.ondemand.com, com.sap.scc.servlets.FatalSccException, tunnel, sa31, connection failure , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , BC-CP-CON , Cloud to On-premise Connectivity service , BC-CP-CON-CF , Cloud Foundry to On-premise Connectivity service , Problem