With EAP-PEAP the supplicant (e.g. WIndows client) doesn't even need to trust the Authenticating Server (i.e. ACS/ISE) since this is an optional thing. And since EAP-PEAP doesn't use client-side certificates, the whole setup and testing is quite easy ... as you found out.
With EAP-TLS however, the supplicant provides a certificate to ACS. And if I understand your question, this is where you are having issues. ACS has to be equipped to trust the CA (Certificate Authority) that issued the supplicant's certificate - and in fact, it need the entire CA certificate chain, if this happens to be more than one CA (e.g. Root CA, Policy CA, Issuing CA). The certificate that the Windows PC (as an example) offers to ACS will be examined. And here I don't know what you want to achieve next: a) Do you want to check whether the client cert was issued by the correct Issuing CA? In that case you need to check the "Issued By" and not the Common Name. or b) Do you want to check each certificate's Common Name to see whether it exists in AD? Remember that each certificate will be issued with a unique Common Name. Thus, what are you trying to check for?
In most cases it's sufficient to check that you are dealing with a client cert that has some characteristic that you like or that you need to enforce - e.g. was it issued by the correct issuing CA (check the "Issued By" field? If yes then happy days.
