New Domain Controller Cannot Enroll for KerberosAuthentication Certificate

The 1722 error can be erroneous and misleading in certificate services. Have you tried this?

https://sites.google.com/site/sergioceokb/microsoft/microsoft-errors