> Source: [sk172547](https://support.checkpoint.com/results/sk/sk172547)

# sk172547 - Capsule Workspace certificate enrollment fails with: "Enrollment Failed" 

| Property | Value |
|----------|-------|
| Solution ID | sk172547 |
| Date Created | 2021-03-14 |
| Last Modified | 2025-08-12 |
| Technical Level | Advanced |
| Products | Other |
| Versions | Not Version-Specific |
| OS | Gaia |

## Symptoms

- * Enrolling the certificate on a cellphone fails with: "Enrollment Failed".

* cvpnd debug shows:  

  ```
  
  [PID][DATE TIME] EnrollForCACert_GetEOTP_cb: cpca response Set:
   (
  	:"return code" (-1)
  	:"error message" ("Failed fetching encrypted OTP.")
  )
  
  [PID][DATE TIME] EnrollForCACert_GetEOTP_cb: Got error code in response: -1.
  [PID][DATE TIME] EnrollForCACert_GetEOTP_cb: failed tp get OTP 
  [PID][DATE TIME] EnrollForCACert_GetEOTP_cb: 
  [PID][DATE TIME] CA_GetEOTP_Cb:  Entering.
  [PID][DATE TIME] DecryptOTP: entered.
  [PID][DATE TIME] cpSRSA_imp::Decrypt Entering...
  [PID][DATE TIME] DecryptOTP: problem decrypting OTP rc: -1003
  ```

* cpca debug on Security Management server shows:  

  ```
  
  [cpca PID]@mgr[DATE TIME] SQLQuery::init: prepare succeeded
  [cpca PID]@mgr[DATE TIME] SQLQuery::setStr: :cn (#1) --> cn=xxxx vpn certificate,o=xxxx..5f9u5g
  [cpca PID]@mgr[DATE TIME] SQLQuery::setInt: :status (#2) --> 1
  [cpca PID]@mgr[DATE TIME] IcaDBManager::DBSelect: sqlite3_step finished after 0 steps
  [cpca PID]@mgr[DATE TIME] fwCA::GetEncryptedOTP: invalid cert. dn is "xxxx VPN Certificate,O=xxxx..5f9u5g"
  [cpca PID]@mgr[DATE TIME] fwCA::GetEncryptedOTP_Wrap: could not get encrypted OTP. rc: -1088
  [cpca PID]@mgr[DATE TIME] http_post_external_cmd_callback: Failed fetching encrypted OTP.
  [cpca PID]@mgr[DATE TIME] IcaDBManager::RunSqliteStatement: SQLite statement 'ROLLBACK'
  [cpca PID]@mgr[DATE TIME] IcaDBManager::RunSqliteStatement: Succeeded to execute SQLite statement, rows affected: -1
  [cpca PID]@mgr[DATE TIME] http_post_external_cmd_callback: return set:
   (
  	:"return code" (-1)
  	:"error message" ("Failed fetching encrypted OTP.")
  )
  ```

  <br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content