Configure Orchestrator for MSCA Inventory
The domain user that the Universal Orchestrator was configured to run as during installation (option #2) needs to be granted access to your MSCA in order to be able to read the certificates from the CA database. The documentation on how to do this is located here.
Once the user has been granted permission to the MSCA, the Orchestrator needs to be configured to perform Remote CA Inventory. The documentation on how to do this is located here.