[XDCR] scram sha connection to target ns_server keeps failing with 400 error

./testrunner -i INI_FILE.ini -p -t xdcr.uniXDCR.unidirectional.verify_ssl_private_key_not_present_in_logs,filename=collectInfo,rdirection=unidirection,demand_encryption=1,skip_cleanup=True

Above test fails with following error:

======================================================================
FAIL: verify_ssl_private_key_not_present_in_logs (xdcr.uniXDCR.unidirectional)
----------------------------------------------------------------------
Traceback (most recent call last):
File "pytests/xdcr/uniXDCR.py", line 395, in verify_ssl_private_key_not_present_in_logs
self.load_with_ops()
File "pytests/xdcr/uniXDCR.py", line 33, in load_with_ops
self.verify_results()
File "pytests/xdcr/xdcrnewbasetests.py", line 3591, in verify_results
self.fail("Incomplete replication: Active key count is incorrect")
AssertionError: Incomplete replication: Active key count is incorrect

----------------------------------------------------------------------
Ran 1 test in 928.298s

Src cluster has 1000 items but target cluster has 500 items only but replication thinks it is all caught up - error:

2018-04-05T22:11:20.949-07:00 INFO GOXDCR.PipelineMgr: Try to fix Pipeline 34497a97dfe0c0ed7a9d4b961bbe55c4/default/default. Current error(s)=r.update_err_ch : TopoChangeDet:Received unexpected status code when making SCRAM-SHA connection. baseURL=172.23.123.244:8091, path=_goxdcr/_pre_replicate/default?bucket_uuid=22731acb4bd7b4c70fad388b6d960b0f, statusCode=400