All servers needs to support Kerberos and are member of a trusted domain. The webservers must be trusted for delegation and the SPN's needs to be setup for each name that the client will access.
When you create a new SPN for you CRM web server, you need to determine the account that's used in the IIS application pool.
If you use a specific domain account the SPN statement should look like this:
setspn -a http/<name> <domain\username>
If you use a computer account (local system or Network Service) you can use this syntax
setSPN -a http/<name> <netbios name server>
You also need to check the SPN for the SQL service. Although it's created when you install SQL server there can be different reasons why it's not configured correctly.
You can check Principle Names using:
setSPN -I <computer>
If you need to set a new SPN for the SQL service, the syntax could be:
setspn -a mssqlsvc/<database.domain.local> <domain\username>
Hopes this helps! Drop me a line if you have more questions....