Here are the list of steps that you can take to fix the Token error
1. Ensure SMA is able to resolve the interface hostname of the ESA it connects to.
2. ESA has API and trailblazer enabled and reachable from SMA. This also means that the ESA should be able to resolve its own interface hostnames as pointed in earlier comments to enable trailblazer.
3. ESA needs to trust the certificate authority assigned to the ESA interface (which it is connecting to) . You can additionally try by disabling cert validation on validation. Below is the snippet from user guide,
If the managed Cisco Email Security appliance is using a certificate whose Certificate Authority does not exist in the Cisco Content Security Management appliance trust store, the server certificate validation on the Content Security Management appliance fails. To allow communication, add the Certificate Authority of the signed certificate used by the Cisco Email Security appliance to the Cisco Content Security Management appliance. To add the Certificate Authority, use certconfig > CERTAUTHORITY sub command in the CLI."
The ESA is using the demo certificate which is self signed. We cannot add this into the SMA CA trust store becuase its not exactly CA certificate type
They are 2 options,
1. get a certificate signed by 3rd party (involved cost) or internal CA, assign it to the interface of ESA, then add the CA to the SMA trust store
2. Disable certificate verification on the SMA so that it connect without validating the ESA cert (not recommended), even user guide says so consider security
CAUTION: If you want to disable the server certificate validation on the Content Security Management appliance, use the esaapiconfig command in the CLI. Cisco does not recommend you to disable the certificate validation for security reasons
