Get the Certificate list
Get-ChildItem -Path “cert:\LocalMachine\My”
The certificate you need to find should be a certificate used for Client Auth and from the template you specified setting up you CM in HTTPS mode. Once you have the correct cert you can run the following command:
$cert = Get-ChildItem -Path "cert:\LocalMachine\My\<ThumbprintOfCert>"
Invoke-WebRequest -Uri "https://<mp_server_name>/sms_mp/.sms_aut?mplist" -Certificate $cert
One thing I noticed if that you try and run these command from a client that allows TLS 1.0 or TLS 1.1 against an MP that is running on Windows Server 2019 it will fail. This is because WS 2019 only accepts TLS1.2 traffic. To force PowerShell and Invoke-WebRequest to use TLS1.2 the following line must be specified before you run the above commands:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
This is only valid for the current PowerShell session and must be specified every time you start a new session.