3729614 - Principal Propagation raises HTTP 401 from ICM trace when handling inbound request from SAP Cloud Connector

While testing BTP application authentication via Principal Propagation, it's perceived from dev_icm Level 2 trace at the backend system, following error is raised.

====
[Thr 2028] CONNECTION (id=0/xxxx):
    used: 1, type: default, role: Server(1), stateful: 0
    NI_HDL: 100, protocol: HTTPS(2)
    local host:  xx.xx.xx.xx:xxx ()
    remote host: xx.xx.xx.xxx:xxxxx ()

[Thr 2028] <<- SapSSLSessionInit()==SAP_O_K
[Thr 2028]      in: args = "role=2 (SERVER), auth_type=1 (ASK_CLIENT_CERT)"
[Thr 2028] XXX XXX xx xx:xx:xx:xxx 20xx
[Thr 2028]     out: sssl_hdl = 1bcfxxxxxxxxxxxxxxx)==SAP_O_K
[Thr 2028]      in: ... = "cred_hdl=00000xxxxxxxxxxxx  (cred_name=E:\usr\sap\XXX\xxxxxxxx\sec\SAPSSLS.pse)"

[Thr 2028] HTTP response (raw) [0/xxxxxxx/1]:
[Thr 2028]   HTTP/1.1 401 Unauthorized
[Thr 2028]   set-cookie: sap-usercontext=sap-client=110; path=/
[Thr 2028]   content-type: text/html; charset=utf-8
[Thr 2028]   content-length: 1055
[Thr 2028]   sap-system: XXX
====

• SAP Cloud Connector(SCC);
• Business Technology Platform(BTP);
• SAP AS ABAP Netweaver.

SAP cloud connector, connector, cloud connector, SCC, CC SAP CC, ASK_CLIENT_CERT, certificate, profile, auth, authentication, PP, principal propagation, sample certificate, HTTPS, ICM, backend system , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , BC-SEC-LGN , Authentication , Problem