Hello.
I have a separate server for the ndes role.
As I said my original post, I was able to generate a certificate for the device manually.
It seems that the automatic process could not get the Enroll password from the ndes server. I see nothing in the ndes logs but this :
2021-10-26 14:47:54 172.16.99.47 GET /CertSrv/mscep_admin/ – 80 *****\svcndes 172.**.***.39 client-service – 200 0 0 142