Hi,
Before going further, would you please tell more information about your PKI environment?
You have confirmed that the CA are working well, right?
If it is a enterprise CA, you can check the status by pkiview.msc. If possible, you can share a screenshot here!
Then you can refer to the following steps to request a cert using "enroll on behalf of":
https://learn.microsoft.com/en-us/answers/questions/369669/no-certificates-meet-the-application-criteria.html
Best Regards,