Enrolling iOS via Web enrollment An error has occured... Something unexpected happened

[rmann100]

Airwatch WorkSpace One UEM, 22.3.0.18 (2203), IOS devices, Error message = "An error has occured... Something unexpected happened. if this issue persists contact your IT administrator" and a picture of a beach. We are trying to enroll any iOS devices via web portal and it lets us enter our Group ID, UserID and Password, then when it gets to the download profile this error pops up. have tried multiple devices. we have recently undergone a server migration from server 2008 to 2019 on version 1909 and then upgraded from 1903 to 2203. Same results if we use the HUB app. 

[Noordan]

Do you have "Sign Profiles" enabled in the console settings?
You can find that setting here: Groups & Settings / All settings / Devices & Users / Apple / profiles.

I have seen some similar issue if we have Sign profiles enabled and the server don't have the whole certificate chain of the public certificate or if the server can't reach the crl list for the public certificate.

Can you see any errors in the logfiles on the DS-server?

[rmann100]

Thank you for your reply -

We do have "sign profiles" enabled.

in the Device Services log I see the following: "Error    WanderingWiFi.AirWatch.DeviceServices.BusinessImpl.IOSDeviceBusiness.ProcessDeviceCheckInAsync    Unsuccessful device authentication, invalid signature in Token Update with certificate [Subject]" then the certificate details. this error occurs several times in the logs."

This particular Certificate is not found in the Console server (we are on prem) should it be do you know? 

[Noordan]

What certificate are the log complaining about? 
Internal AW certificate, a public certificate, or a self-signed certificate?

[rmann100]

I am assuming a public because I cannot find the Serial in our local server's certificate stores and does not match any self signed. Thanks 

[Noordan · Accepted solution]

One thing you can do in a testing purpose is to disable "Sign Profiles" and try enroll to see if that works.

If that works I think you have to find exactly which certificate the logs are referring to. And when you have find that you have to check that you have access to CRL lists for that certificate and the servers also need to have the full chain. Those two things is common issues if the servers are on-prem and if the server don't have unrestricted outbound internet access.

I think you can see some certificate related stuffs in the CAPI2 logs in event viewer. 

[rmann100]

Thank you! this was the issue "Sign Certificates"