Troubleshooting SAP BTP Trial to S/4HANA On-Prem: The Cloud Connector Checklist

Dr. Sarah Chen breaks down what you need to know

Your BTP trial subaccount has been stable for weeks, and then the destination test against your on-premise S/4HANA system fails. The Cloud Connector reports green, yet “no route to host” or an obscure 401 error appears. After debugging dozens of these scenarios across customer landscapes, I’ve consolidated a forensic, layer-by-layer methodology that cuts straight to the root cause.

The Real Connectivity Stack Under Pressure

The problem isn’t usually one misconfiguration—it’s a chain of tolerances that breaks under a single subtle change: a firewall rule update, an expired certificate, a mismatch in the virtual host mapping. Because BTP trial subaccounts can only connect one Cloud Connector instance, any misstep leaves you dead in the water. The typical stack looks like this:

• BTP trial subaccount → Destination Service → Connectivity Service
• Cloud Connector (on-prem DMZ) → Reverse Invoke tunnel to BTP
• S/4HANA application server (HTTP/RFC endpoints)

Each layer must be verified independently before blaming the next.

What This Means for You

From my experience, 80% of failures cluster around three overlooked areas:

1. Subaccount mapping and status – The Cloud Connector UI may show Connected, but confirm the exact subaccount ID matches. In trial environments, I’ve seen recreated subaccounts leave stale connectors that silently fail to forward traffic.

2. Virtual host ↔ physical host mismatch – The destination’s URL and Proxy Type: OnPremise must resolve exactly to the virtual host defined in the Cloud Connector’s “Cloud To On-Premise” access control mapping, not the S/4HANA physical FQDN. A common mistake: using the physical host in the destination, which bypasses the connector entirely and results in a “connection timed out” error.

3. SSL trust across the tunnel – The Cloud Connector acts as a reverse proxy with its own trust store. The backend S/4HANA’s certificate must be trusted by the Java Keystore on the Connector host. In trial setups where certificates are self‑signed or issued by an internal CA, the default trust isn’t enough. I’ve seen bizarre javax.net.ssl.SSLHandshakeException errors because the intermediate CA chain was incomplete.

Action Items: A Layer‑by‑Layer Checklist

Break down diagnostics into five layers. Test each before moving on.

1. Cloud Connector Level

• Validate subaccount: In the Cloud Connector administration UI, confirm the Account Name and Subaccount ID under the “Connector” tab match the target trial subaccount.
• Check the tunnel: Status must show Connected. If not, review proxy/firewall rules: the Connector must reach *.eu10.hana.ondemand.com:443 or your region’s equivalent. Port 443 outbound is mandatory.
• Inspect logs: The Connector’s ljs_trace.log (default /usr/sap/scc/logs) often holds the key. Look for:

  java.net.ConnectException: Connection refused
  ...
  Failed to establish a tunnel connection
  

  This indicates the cloud-side connectivity service can’t reach the Connector’s tunnel endpoint, usually a certificate or port‑blocking issue.

2. Network & Port Reachability

From the Cloud Connector host’s OS, manually test connectivity to the S/4HANA backend:

curl -v https://<S4H-virtual-host>:443/sap/bc/ping

• Port 443 is needed for HTTPS.
• Port 3299 (RFC via PCo/WebSocket) is required if using RFC destinations.
• Port 8200 is the Cloud Connector’s internal proxy; don’t confuse it with backend ports.
• If the curl test fails, escalate to the network team. Firewall rules between DMZ and internal SAP servers are the most frequent culprit.

3. Destination Configuration in BTP Cockpit

The destination must declare:

• Proxy Type: OnPremise (forces the connectivity service to use the Cloud Connector tunnel)
• URL: https://<virtual-host>:443 — this must exactly match the virtual host defined in the Connector’s mapping, not the internal IP.
• Authentication: If you use Basic or Principal Propagation, the user must exist in S/4HANA. For trial subaccounts, be aware that the default identity provider might not issue trusted SAML assertions for principal propagation without extra configuration.

Example destination snippet:

Name: S4H_OP
Type: HTTP
URL: 
ProxyType: OnPremise
Authentication: BasicAuthentication
User: mytestuser
Password: ***

4. Backend S/4HANA Readiness

• The /sap/bc/icf/ping service must be active (transaction SICF, activate node default_host > /sap/bc/icf).
• The HTTP service must listen on the port you’re targeting in the Cloud Connector virtual mapping—verify via SMICM.
• For RFC, ensure the gateway is running and the registered program is reachable.

5. SSL Certificate Trust

• Export the S/4HANA endpoint’s certificate:
  openssl s_client -showcerts -connect <backend-host>:443 </dev/null > backend-onprem.pem
• Import it into the Connector’s Java trust store (typically sapjvm’s cacerts) or into the dedicated trust location configured

References

• Connection Issue Between SAP BTP Trial and S/4HANA…- SAP HANA Platform Overview- SAP S/4HANA Product Information

References

• SAP S/4HANA Product Information
• Connection Issue Between SAP BTP Trial and S/4HANA…
• SAP HANA Platform Overview