Make sure that:
The following server roles are installed on a Windows Server® 2012 or later:
Active Directory Domain Services
Active Directory Certificate Services
The following are installed on Active Directory Certificate Services:
Certificate authority (CA)
Certificate Enrollment Web Service
The printer is enrolled to the Active Directory® domain.