YES, you are limited to three certificate templates per hierarchy and each of these certificate templates are restricted to the three key usages that the Network Device Enrollment SERVICE supports: signing, encryption, and both signing and encryption. So, for example, you couldn’t use two certificate templates that supported both signing and encryption.

Although different servers running the Network Device Enrollment Service can be configured to use different certificate templates, Configuration Manager cannot support this configuration because you cannot assign clients to specific servers. If you have multiple certificate registration point site system servers in the hierarchy that communicate with multiple servers running the Network Device Enrollment Service, Configuration Manager non-deterministically assigns clients to the AVAILABLE servers to automatically load balance the REQUESTS.

Yes, you are limited to three certificate templates per hierarchy and each of these certificate templates are restricted to the three key usages that the Network Device Enrollment Service supports: signing, encryption, and both signing and encryption. So, for example, you couldn’t use two certificate templates that supported both signing and encryption.

Although different servers running the Network Device Enrollment Service can be configured to use different certificate templates, Configuration Manager cannot support this configuration because you cannot assign clients to specific servers. If you have multiple certificate registration point site system servers in the hierarchy that communicate with multiple servers running the Network Device Enrollment Service, Configuration Manager non-deterministically assigns clients to the available servers to automatically load balance the requests.