ActiveDirectory domain service wizard: Prerequisites check for domain controller upgrade fails

If you have already added the Active Directory Certificate Services before promoting it to a Domain Controller, remove the Certificate Services role, and then add the AD DS role again.

If the "Add Roles and Features" wizard does not allow you to remove Active Directory Certificate Services" (checkbox is greyed out), then you can remove it using the following PowerShell command:

Remove-WindowsFeature -Name AD-Certificate

See also: https://serverfault.com/a/717841/239616