IPSEC/2/hwIPSecPkiCmpDownloadCertFail_active: The CMP session failed to download certificate. (SessionName=[SessionName],RequestType=[RequestType])
Run the ping command to check whether the route between the device and CMP server is reachable. If the route is unreachable, check the route and link to ensure that the route is reachable.
Check whether the CMP server is running properly. If not, make sure that the service of the CMP server is normal.