Certificate Auto Enrollment in Samba with CEP/CES isn't working against Windows 2025 as support for channel binding is missing in python-requests-gssapi. This is required since 2024-12.

This is also known as Extended Protection for Authentication.

See

https://msrc.microsoft.com/blog/2024/12/mitigating-ntlm-relay-attacks-by-default/
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/2c3ea153-eff9-46a7-8614-19b677efa4e0