Network Device Enrollment Service (NDES) requests two certificates according the following two certificate templates configured with the "Intended purpose" (Enhanced Key Usages) set to "Certificate Request Agent": CEP Encryption. Exchange Enrollment Agent (Offline request).
ReadCreate free certificate from Lets`s encrypt to create a Exchange Lab.
Read