3802069 - SAP Cloud Integration: Client certificate authentication fails HTTP 401 Unauthorized error due to invalid PEM formatting in service key

• In SAP Cloud Integration (Cloud Foundry environment), inbound HTTPS calls to an integration flow that requires Client Certificate Authentication fail with HTTP 401 Unauthorized. 
• The client certificate is CA-signed and includes the Client Authentication EKU as per 3682752, and the sender system trusts a Load Balancer root CA listed in Load Balancer Root Certificates Supported by SAP, but authentication still fails. 
• The external client certificate is maintained in the service key as described in Cloud Integration on CF – How to Setup Secure HTTP Inbound Connection with Client Certificates or https://wiki.scn.sap.com/wiki/x/qQGJIg. 
• The problem can occur when the PEM-encoded certificate pasted into the service key contains extra spaces or blank lines around the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers. 

"Image / Data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental"

• SAP Cloud Integration, Cloud Foundry environment
• SAP Integration Suite
• SAP Business Technology Platform

Cloud Integration, SAP Cloud Platform Integration, Cloud Platform Integration, SAP CPI, CPI, SCPI, HANA Cloud Integration, HCI, SAP HCI, client certificate, authentication, external client certificate, service key, service instance, Cloud Foundry, 401, unauthorized, inbound communication, inbound call , KBA , LOD-HCI-PI-OPS , Cloud Operations , Problem