Troubleshoot certificate management on CA server

Updated: June 8, 2026

Want to summarize with AI?

Provides troubleshooting information for certificate management on CA server with error types, messages, root causes, and resolution steps.

This reference provides troubleshooting information for certificate management on CA server.


Error type	Error message	Pausible root cause	Troubleshooting steps
Internal server error	`https://<est-url>:443/.well-known/est/simpleenroll<br>HTTP Status Code: 500<br>500 Internal Server Error`	The CA server responds with a 500 error. High CPU or memory usage on the CA server.	Check CA server logs for error details. Check resource utilization on CA server. Increase resource limits if necessary.
Timeout error	`Failed to get CSR signed for <device-id>, Failure reason - Read timed out<br>HTTP Status Code: 0`	The API call to the CA server times out due to resource issues in CPU, memory, or enrollment rate limits on the CA server.	Increase resource limits or enrollment rate on the CA server.
Unauthorized Error	`Failed to get CSR signed for <device-id>, Failure reason - Simple Enroll: https://<est-url>:443/.well-known/est/simpleenroll HTTP Status Code: 401`	Authentication or configuration issue. Incorrect or missing EST password. EST client certificate lacks TLS authorization. EST alias configurations are incorrect.	Verify EST password in Cisco SD-WAN Manager and ensure that it matches CA server. Check EST client certificate support for TLS authorization. Check EST Alias configurations. For SCEP, ensure correct challenge password is used.
EST Configuration Failure / Timeout	Loss of OMP connection with controller. Sync of root-CA certificate failed on controllers.	Failed Netconf, permission errors, or device/controller issues.	Check logs for issues on devices/controllers.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.