SAP Knowledge Base Article - Preview

3830550 - "Unable to generate authorization token (401)" error via principal propagation after CA certificate expired in SAP Cloud Connector

Symptom

  • Apps accessed using Principal Propagation authentication return HTTP 401 Unauthorized.
  • Error message: "Unable to generate authorization token".
  • SAP Cloud Connector scc_core.trc log shows:
    "#ERROR#com.sap.core.connectivity.protocol.http.handlers.HttpAuthenticationHandler#tunnel-client-xx-x#xxxxxxxxx#Unable to generate authorization token
    java.lang.IllegalStateException: CA certificate has expired on 2026-01-01 01:01:11 +0000, which is not allowed for supporting Principal Propagation."

**Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental.


Read more...

Environment

SAP Cloud Connector release independent.

Product

CONNECTOR FRAMEWORK all versions ; SAP Connectivity service all versions

Keywords

authorization token, 401 unauthorized, cloud connector, principal propagation, ca certificate expired, local ca, short-lived certificate, login prompt, basic authentication, btp destination, certrule, certificate renewal, fiori app, odata, scc , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.