Third-party Certificate Authority Configuration for SmartCard Logo

I've configured a Domain Controller following the MS instructions for having
a third-party certificate-authority issue the certificates. These
certificates do work in their environment... and ours as well, inconsistently.

In order to get the "inconsistent success" I've put the certificates in just
about every place a certificate can go, on both client and DC (this includes
the domain global policy locations).

Is there any better documentation on how to diagnose an error "An untrusted
certificate authority was found......"? I can run certutil -verify
-enterprise (with/without)-urlfetch <card-cert> on both client and server
without failure...