Delegation must be enabled for the web service account when the Certificate Enrollment Web Service is installed and all of ...

Delegation must be enabled for the web service account when the Certificate Enrollment Web Service is installed and all of the following conditions apply:
1. The Certificate Enrollment Web Service is installed on a separate computer from the certification authority
2. Renewal-only mode is not enabled
3. The authentication type is set for Kerberos or Certificate Authentication