I wracked my brains last week trying to figure out why my cryptpad.DOMAIN.XYZ was loading but nothing else would (docs, sheets, logging in, etc) - It kept throwing a complaint at me about the sandbox.DOMAIN.XYZ being insecure...
All I did was delete the line for the ServerAlias in the example config in the git repo. Once that was gone, I reloaded apache and bam! Things are apparently working well now. I hope this information proves useful to someone else.