You verified the request printed by

--tls_dump

contains the correct enroll secret?

What else do you think the issue could be?