Common Network Device Enrollment Service (NDES) configuration wizard failures

Nietschy - So when security any of the CA web-based roles that require any kind of authentication you have to be careful.  When following the PetitPotam NTLM Relay Attack mitigation it talks about setting Extended Protection for Authentication (EPA) on the site.  

Enabling EPA is fine, as long as ONLY Windows clients are going to the site.  I have seen anytime that a phone, Linux/Unix, or Mac goes to a site with EPA required it will fail. This also includes CURL.  It seems that for some reason these other operating systems do not implement EPA at this time.  

So the first suggestion I would tell you is to disable EPA on the website, and then do an IISReset on the NDES Server, and try your testing again.