For RA agent enrollment, an agent must submit a pin creation request first before performing certificate enrollment.