This article explains an issue where SRX fails to enrol with Sky-ATP.

While running the enrolment script on SRX, you might see an error like this:

User@SRX> request services advanced-anti-malware enrol https://apac.sky.junipersecurity.net/v2/skyatp/ui_api/bootstrap/enroll/3c55ym75tw90gk4d/7n2c0jlvujzdmozi.slax

An error occurred, please check the realm name, email or password.

If you go ahead and run the op-script command copied from Sky-ATP portal for the enrolment, you might see an error like shown below:

User@SRX> op url https://apac.sky.junipersecurity.net/v2/skyatp/ui_api/bootstrap/enroll/3c55ym75tw90gk4d/7n2c0jlvujzdmozi.slax

Platform is supported by ATP Cloud: SRX1500.
Version 22.4R2-S2.6 is valid for bootstrapping.
Junos Image Version: 22.4R2-S2.6...
Junos version 22.4 does not supports https endpoints.
Going to enroll single device for SRX1500: xxxxxxxxx with hostname SRX.
Application Signature DB version on this device is: 3798. Using latest version of Application Signature DB is recommended.
Communicate with cloud...
License type for this device: premium.
License of your device will expire in 313 days.
Remove related security-intelligence service configurations...
Remove related advanced-anti-malware service configurations...
Remove related SSL service configurations...
Remove related PKI configurations...
Clear local certificate aamw-srx-cert...
Clear key pair: aamw-srx-cert...
Clear CA profile aamw-cloud-ca...
Clear CA profile aamw-secintel-ca...
Configure CA...
Request aamw-secintel-ca CA...
Wait aamw-secintel-ca CA download status...
Load aamw-secintel-ca CA...
Request aamw-cloud-ca CA...
Wait aamw-cloud-ca CA download status...
Load aamw-cloud-ca CA...
Retrieve CA profile aamw-ca...
error: [Error] Get CA certificates failed: aamw-ca.
Please run diagnostic process with the following cli command:
request services advanced-anti-malware diagnostics srxapi.ap-northeast-1.sky.junipersecurity.net detail pre-detection

Op-script logs from the /var/log/op-script file will display errors while fetching the certificates as shown below:

Apr 21 13:36:04: Result for request command request security pki ca-certificate enroll ca-profile aamw-ca: 
pki-service
Command aborted as certificate enrollment failed
Apr 21 13:36:04: get-ca-status() 
Apr 21 13:36:04 [Error] Get CA certificates failed: aamw-ca.

While trying to enrol the device with Sky-ATP, certificates for the https connection are pushed to SRX and the above mentioned issue issue can be seen if SRX is failing to fetch the certificates during the enrolment process. This can happen if any kind of filtering like url filtering is being done on any upstream device in the network which could be blocking the connection. During the enrolment process SRX tries to access different sub-domains like "http://va.junipersecurity.net/ca/SecInteljunipersecuritynetCA.pem" and "http://va.junipersecurity.net/ca/SecInteljunipersecuritynetsubCAforCloud.pem" to fetch the required certificates and it is important that none of these URLs are being blocked in the network on any upstream device. You also need to make sure well known ports like 443, 80 and 8080 are also allowed in the network for the enrolment to complete.