You need to have the Kerberos Authentication certificate on all the domain controllers. To enroll for a new certificate follow the below steps.
1.On the domain controller, open mmc.
2.Click File, Click Add/Remove Snap-in.
3.Select Certificates, click Add, then select Computer account.
4.Expand Certificates (Local Computer), right-click Personal, click All Tasks, and then click Request New Certificate.
6.Select Kerberos Authentication and press Enroll.
Note: If you do not see the Kerberos Authentication on the Auto Enrollment in the Domain Controller certificate mmc, you need to go to Certificate Authority server and add the domain controller in the security of the Domain Controller Authentication Template and give AutoEnroll permissions.
Also, make sure you have configured krb5.conf on the VDA with the correct RootCA & Subordinate CA certificate information.
Refer ‘Incorrect root CA certificate configuration’ section in the below link: