I am primarily a Linux admin, and this might be a Windows problem... In fact, this might not even be the right forum for me to be asking this question, but I don't know which Windows forum would give me the time of day, so I'm here... I might also try some Windows Reddit groups... :p The following domain names are obscured to protect the wicked; I know not to use fake domains ;) 

I have an IPA server called dc.domain.local, an ActiveDirectory Directory Server called pdc.win.domain.local, and a ActiveDirectory Certificate Server called pki.win.domain.local.  I am trying to configure the ADDS as a subdomain of the IPA domain. I am using A and NS Records to delegate the subdomain name. I am NOT attempting to create a interforest trust between these two domains at this time (Although, as an aside, there will eventually be another IPA server at pdc.lin.rxrhouse.net for subdomain lin.domain.local, and THAT one will have an interforest trust with win.rxrhouse.net; If IPA-IPA Trusts ever become a "thing", the top domain will get trusts to both subdomains, but for now, pki.win.domain.local only needs to 1) have a signed subordinate certificate from dc.domain.local, and 2) run). As I have been able to get it, ADCS seems to be installed with a signed cert, but it won't run. 

I installed ADCS as an Enterprise Subordinate CA; Based on https://frasertweedale.github.io/blog-redhat/posts/2017-08-14-ad-cs.html, I added win.domain.local as a host principal on IPA. I used that principal to sign the CSR, which worked fine. I installed that certificate back to AD. AD prompted for the Root Certificate, which I provided, and AD warned that it couldn't verify the chain of trust because it couldn't contact a CRL. 

But now ADCS won't start... Every time I try to start it, it complains, again, that it can't reach a CRL. 

In Windows Server Manager, in Certificate Authority manager (CertSrv), right click on the CA tree, under Properties... I see that all of the CRL Distribution Points (CDPs) and AIAs are their default, non-configured forms... It's my crude guess that I need to be pointing those values to IPA? The example is of the form  http://<ServerDNSName>/CertEnroll/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl, if that hint prompts anyone's thinking... 

Even if you have a suggestion of another forum to ask this on, I'm all ears. Thank you for your assistance! 

--
Tyrell Jentink