I'm playing with the Windows Server CA role and Smart Card logons. We have a working PKI setup and smart card issuance/logon working. What I'm curious about is the "Require this number of authorized signatures" option in the "Smartcard Logon Template" and how to view the signatures. To me, it makes sense that this option is useful since a certificate from this template will need an authorized signature from another trusted person/party, and prevent arbitrary people from issuing smart card logon certificates (provided the Enrollment Agent is secured properly). I'm able to issue certificates with this option checked, but I'm not sure how to view what certificate was used to sign the logon certificate.
My signing certificate was taken from a nearly unedited copy of the "Enrollment Agent" certificate template, and issued without trouble. When I issue a smart card logon certificate, I'm prompted to select a signing certificate (which is the Enrollment Agent certificate) and after selecting it, I can issue the logon certificate just fine. When I inspect the certificate (double click the cert in the Windows CA snap-in) the chain only shows my CA, with the certificate itself right below that. I understand I'm only signing the certificate, not an intermediate CA, but shouldn't something from my signing cert appear in the chain/details?
certutil -scinfo shows the chain is verified and has two "CertContext" entries, though nothing there nor in the validation chain, or anywhere in the output is any indication that I signed the certificate.
tl;dr, if my signature is required for certificate issuance, shouldn't something relating to me appear in the final certificate data?