The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect.

There could be multiple reasons, and try one of below

1. While installing NDES, when you use domain account as service account, and change it to AppPoolIdentity(in AppPool settings screen), then you may face this error. For this you have either revert it to domain account or give private key Read permission for CEP Encryption(CEPEncryption) and Exchange Enrollment Agent(offline request) to SCEP app pool identity.