Security Content Migration fails with TransportManagementBackendException: No DNS name found in the system property or user provided certificate

When migrating security content from a Neo Integration Suite tenant to a Cloud Foundry Integration Suite tenant, all security artifact migration tasks fail with the following exception:

com.sap.it.cm.transport.exception.TransportManagementBackendException:
No DNS name found in the system property or user provided certificate

The migration job starts successfully and package migration proceeds, but every security content type fails.

Affected migration items include:

JDBC Datasources
Keystores
Known Hosts
OAuth Authorization Codes
PGP Keys
User Credentials
Environment
Source: SAP Integration Suite (Neo)
Target: SAP Integration Suite (Cloud Foundry)
Migration Tool: SAP Cloud Integration Migration Tool
Region: eu20-001

Steps Performed:
-Registered both Neo and Cloud Foundry tenants.
-Configured the Cloud Foundry Platform Host.
-Configured OAuth Service Key.
-Exported the Cloud Foundry sap_cloudintegrationcertificate.
-Imported that certificate into the Neo tenant keystore.
-Configured the imported certificate alias (cf_transport) in the Register Tenants application.
-Started the migration job.

The migration job starts successfully, indicating that tenant registration and authentication are correctly configured.

Error

Every security content migration task fails with:

Migration task Exception:
com.sap.it.cm.transport.exception.TransportManagementBackendException:
No DNS name found in the system property or user provided certificate
Investigation

The Cloud Foundry-generated sap_cloudintegrationcertificate was inspected using OpenSSL:

openssl x509 -in sap_cloudintegrationcertificate.cer -text -noout

The certificate contains:

Subject CN:

b386a8db-18d6-4b51-a503-eab739423d81.cpi.hana.ondemand.com
Key Usage
Extended Key Usage
CRL Distribution Points

However, it does not contain an X509v3 Subject Alternative Name extension.

Example of the extensions present:

X509v3 Basic Constraints
X509v3 Authority Key Identifier
X509v3 Subject Key Identifier
X509v3 Key Usage
X509v3 Extended Key Usage
X509v3 CRL Distribution Points

There is no:

X509v3 Subject Alternative Name
Question

Does the migration backend require a DNS Subject Alternative Name (SAN) in the Cloud Foundry sap_cloudintegrationcertificate?

If so:

Is this expected for newly provisioned Cloud Foundry tenants?
Is there a supported way to generate a certificate containing the required SAN?
Or is the migration tool incorrectly assuming that the generated certificate always contains a DNS SAN?

The exception message suggests that the migration backend attempts to obtain a DNS name from the certificate but is unable to find one.

Start by reproducing the security-content migration and reviewing the migration task logs around the TransportManagementBackendException. Inspect the provided sap_cloudintegrationcertificate with the OpenSSL command shown in the issue and trace how the migration tool obtains the DNS name. Done means identifying whether the certificate or backend handling is responsible and recording a supported resolution.