A tip for getting this to work is to ensure that there are no hyphens in the AD cert template name in the MDM profile.
Otherwise the CA will be asked for a template name truncated at the first hyphen (minus sign). This applies equally to an AD Cert MDM profile that does not use the JAMF AD CS Connector (for AD-joined devices on network), or to the Certificate MDM profile for the connector.
Hope that helps someone else avoid some head-scratching.
