NDES and the dreaded 2 & 10 Event ids stating “The parameter is incorrect"

This error can also show up if the CEP certificate is created with the incorrect settings (in my case from copying the other RA certificate's INF without paying close enough attention).

The correct settings are:

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=hostname-MSCEP-RA,OU=..."
MachineKeySet=TRUE
KeySpec = 1
KeyUsage = 0x20

[EnhancedKeyUsageExtension]
OID = 1.3.6.1.4.1.311.20.2.1

[RequestAttributes]
CertificateTemplate = CEPEncryption

Pay if the KeySpec and KeyUsage are wrong you get the above error.