cloud connector - failed to connect - handshake timed out after 10000ms

[christoph_ostrop]

cloud connector - failed to connect - handshake timed out after 10000ms

update to latest version is done already - vers. 2.15.0. / nov. 2022

connect for an subaccount failed with error (see above)

[christoph_ostrop]

you have to change trace-level and to analyse logfiles with https://launchpad.support.sap.com/#/notes/2990062

1. Open the cloud connector UI, under log and trace file section:

-> set Cloud Connector Loggers to DEBUG

-> set Other Loggers to Information

-> set Payload Trace flag on (ensure that the affected subaccount is selected in the header)

2. Replicate the issue and send us the following files:

-> ljs_trace.log from cloud connector

-> traffic_trace_<subaccount>_on_<region>.trc from cloud connector

Analysing logfiles with this tool: https://launchpad.support.sap.com/#/notes/2990062

You can refer to KBA 2452568 - Log and Trace files for SAP Cloud Connector for more details.

[christoph_ostrop]

in our case, we got two recommendations for sapnotes:

2837206 - Cloud Connector suddenly stops working and the error "Invalid status of handshake response: 401 Unauthorized" is thrown => https://launchpad.support.sap.com/#/notes/2837206

2971034 - Adding Subaccount in SAP Cloud Connector Fails with Error 417 "An authorization problem occurred when downloading the configuration" => https://launchpad.support.sap.com/#/notes/2971034

[christoph_ostrop · Accepted solution]

i do not know, what SAP had changed

without any changes (on our side)

pressed button CONNECT today and from 30.nov.2022 - it was able to connect again with that subaccount.

[MarkusTolksdorf]

Hi Christoph,

The timeout during TLS handshake indicates a slow network between Cloud Connector and BTP region Europe (Rot), Neo environment. Please check your firewall/proxy.

Best regards,
Markus

[christoph_ostrop]

please see above, in our case, we got two recommendations for sapnotes from analysing with Support Log Assistant Tool:

2837206 - Cloud Connector suddenly stops working and the error "Invalid status of handshake response: 401 Unauthorized" is thrown => https://launchpad.support.sap.com/#/notes/2837206

our sub-account certificate is valid until 07.2023, so it may be this sapnote following:

2971034 - Adding Subaccount in SAP Cloud Connector Fails with Error 417 "An authorization problem occurred when downloading the configuration" => https://launchpad.support.sap.com/#/notes/2971034

.

[AntalP]

Hi Christoph,

In the ljs_trace.log file could you check which connection times out?

There are notification, tunnel and certificate servers.

Also from curl try to check if the URLs are reachable from the cloud connector host.

https://wiki.scn.sap.com/wiki/display/ASJAVA/How+to+check+route+to+SAP+BTP

for example:

curl -v connectivitynotification.hana.ondemand.com:443

curl -v connectivitycertsigning.hana.ondemand.com:443

curl -v connectivitytunnel.hana.ondemand.com:443

Best regards,

Antal

[christoph_ostrop]

root@sccsrv:~$ curl -v connectivitynotification.hana.ondemand.com:443

* About to connect() to connectivitynotification.hana.ondemand.com port 443 (#0)

* Trying 155.56.210.83...

* Connected to connectivitynotification.hana.ondemand.com (155.56.210.83) port 443 (#0)

> GET / HTTP/1.1

> User-Agent: curl/7.29.0

> Host: connectivitynotification.hana.ondemand.com:443

> Accept: */*

>

* Empty reply from server

* Connection #0 to host connectivitynotification.hana.ondemand.com left intact

curl: (52) Empty reply from server

root@sccsrv:~$ curl -v connectivitycertsigning.hana.ondemand.com:443

* About to connect() to connectivitycertsigning.hana.ondemand.com port 443 (#0)

* Trying 155.56.210.43...

* Connected to connectivitycertsigning.hana.ondemand.com (155.56.210.43) port 443 (#0)

> GET / HTTP/1.1

> User-Agent: curl/7.29.0

> Host: connectivitycertsigning.hana.ondemand.com:443

> Accept: */*

>

* Empty reply from server

* Connection #0 to host connectivitycertsigning.hana.ondemand.com left intact

curl: (52) Empty reply from server

root@sccsrv:~$ curl -v connectivitytunnel.hana.ondemand.com:443

* About to connect() to connectivitytunnel.hana.ondemand.com port 443 (#0)

* Trying 155.56.210.84...

* Connected to connectivitytunnel.hana.ondemand.com (155.56.210.84) port 443 (#0)

> GET / HTTP/1.1

> User-Agent: curl/7.29.0

> Host: connectivitytunnel.hana.ondemand.com:443

> Accept: */*

>

* Empty reply from server

* Connection #0 to host connectivitytunnel.hana.ondemand.com left intact

curl: (52) Empty reply from server

root@sccsrv:~$

================================================

from logfile :

2022-11-18 16:10:05,229 +0100#INFO#com.sap.scc.config#https-jsse-nio2-8443-exec-7# #Change tunnel state to enabled on account a568c2195@hana.ondemand.com

2022-11-18 16:10:05,230 +0100#INFO#com.sap.scc.rt#https-jsse-nio2-8443-exec-7# #User Administrator starting Tunnel account:///a568c2195 for account Entwicklung in region hana.ondemand.com

2022-11-18 16:10:15,248 +0100#WARN#io.netty.util.concurrent.DefaultPromise#notification-client-18-1# #An exception was thrown by com.sap.core.connectivity.spi.ssl.SSLHandshakeValidator.operationComplete()

java.util.concurrent.ExecutionException: io.netty.handler.ssl.SslHandshakeTimeoutException: handshake timed out after 10000ms

at io.netty.util.concurrent.DefaultPromise.get(DefaultPromise.java:350)

at com.sap.core.connectivity.spi.ssl.SSLHandshakeValidator.operationComplete(SSLHandshakeValidator.java:36)

at io.netty.util.concurrent.DefaultPromise.notifyListener0(DefaultPromise.java:578)

at io.netty.util.concurrent.DefaultPromise.notifyListeners0(DefaultPromise.java:571)

at io.netty.util.concurrent.DefaultPromise.notifyListenersNow(DefaultPromise.java:550)

at io.netty.util.concurrent.DefaultPromise.notifyListeners(DefaultPromise.java:491)

at io.netty.util.concurrent.DefaultPromise.setValue0(DefaultPromise.java:616)

at io.netty.util.concurrent.DefaultPromise.setFailure0(DefaultPromise.java:609)

at io.netty.util.concurrent.DefaultPromise.tryFailure(DefaultPromise.java:117)

at io.netty.handler.ssl.SslHandler$7.run(SslHandler.java:2118)

at io.netty.util.concurrent.PromiseTask.runTask(PromiseTask.java:98)

at io.netty.util.concurrent.ScheduledFutureTask.run(ScheduledFutureTask.java:153)

at io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:174)

at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:167)

at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:470)

at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:503)

at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997)

at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)

at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)

at java.lang.Thread.run(Thread.java:838)

Caused by: io.netty.handler.ssl.SslHandshakeTimeoutException: handshake timed out after 10000ms

at io.netty.handler.ssl.SslHandler$7.run(SslHandler.java:2115)

... 10 common frames omitted

[Ryan-Crosby]

We recently had this issue after the SSL certificates for some of our back end servers had expired and we needed to update everything in STRUST.

Regards,

Ryan Crosby