KeyUsage

KeyUsage ::= BIT STRING 

{
  digitalSignature   (0), -- verify signature of the certificate, entity authentication
  nonRepudiation     (1), -- recent editions of X.509 have
                          -- renamed this bit to contentCommitment
  keyEncipherment    (2), -- use to encrypt asymmetric private keys 

                          -- or symmetric keys for key transport

  dataEncipherment   (3), -- this will never be set, because keyAgreement is norm
  keyAgreement       (4), -- deriving Symmetric key from public key without encryption,
  keyCertSign        (5), -- for CA Certificates only

                          -- used to verify signatures of public key certificates
  cRLSign            (6),
  encipherOnly       (7), -- valid if keyAgreement is set, encrypts data while 

                          -- performing key management
  decipherOnly       (8)  -- valid if keyAgreement is set, decrypts data while  

                          -- performing key management

}

http://tools.ietf.org/html/rfc5280#page-29
http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/index.jsp?topic=%2Fcom.ibm.help.domino.admin.doc%2FDOC%2FH_KEY_USAGE_EXTENSIONS_FOR_INTERNET_CERTIFICATES_1521_OVER.html

Deserializing to List

If your list is null while serializing, you did expect it to be null when deserializing too. But it will be initialized with zero elements, to avoid this declare it as Array

The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect.

There could be multiple reasons, and try one of below

1. While installing NDES, when you use domain account as service account, and change it to AppPoolIdentity(in AppPool settings screen), then you may face this error. For this you have either revert it to domain account or give private key Read permission for CEP Encryption(CEPEncryption) and Exchange Enrollment Agent(offline request) to SCEP app pool identity.

CA's type is Enterprise or Standalone?

use > certutil -cainfo, this dump lot of information, look for 'CA type' - some thing like below

CA type: 3 -- Stand-alone Root CA
   ENUM_STANDALONE_ROOTCA -- 3

                         or

CA type: 0 -- Enterprise Root CA
    ENUM_ENTERPRISE_ROOTCA -- 0

also command to extract CA Certificate is "certutil  -ca.cert [file name].cer"

and to change/configure expiry date for issued certificates http://support.microsoft.com/kb/254632

NTLM

Nice read here and here and here

In nutshell, Kerberos is better than NTLM. Kerberos contact Domain Controller, gets token and uses it to authenticate user. NTLM contacts Web Server which in turn contacts Domain Controller, gets token and authenticates it. Normally Web sites can be set to use only NTLM or Negotiate(Kerberos will be tried, on failure NTLM will be tried). Just refer below fiddler screen shots for some clue.