Every request under one template fails immediately, with a CSR that is fine. The message: "template version is not enforceable by this build." The template carries a field the policy engine does not implement, and the engine fails closed rather than issuing a certificate that ignores part of its own profile. The message names the field; remove it.
What makes this one confusing is the timing: the template was accepted when it was saved and refused at the first request — so nothing warned you, and the profile may have sat unused for weeks. (Newer builds refuse the unenforceable field at save time for version 1, and warn on edits — an edit is allowed precisely so you can repair a stored document.)
Its sibling: a CDP or AIA block declared fromIssuerConfig while the issuing CA publishes no URLs. Deliberately classed as a malfunction, not a requester error — the requester can do nothing about it; set the CA's publication block.
And a 403 saying "root-ca mode … issues CA certificates only" means you are talking to the root instance — check the heatline. It refuses every leaf profile by design.
Now I can trace a refused issuance to the document that caused it.