I know this is very old and the latest - and sole - contribution to the topic is from June 2017 but the error in the given example does not stem from an ISE malfunction or bug. In my opinion, the enrollment URL points to the wrong path. The switch will receive the CA certificate when "/pkiclient" is omitted.