KDC error - Cannot find a suitable certificate to use for Smart Card Logons (Hello for Business)

I'd'a said to check the Issuing CA certificate was in NTAuthCertificates. Enterprise CAs put themselves there by default if installed with sufficient permissions, but sometimes they get removed for enhanced security, or not updated for other reasons. A client won't attempt smart card logon unless the Issuing CA cert (i.e. the Issuer of the DC cert) is in that store.