When building a vanilla Windows 2019 certificate authority as a Enterprise Sub-CA after successful configuration of the certificate authority (with the normal warning about needing to sign the req) the service fails to start with error 27: