Your configuration looks like an interesting blend of authentication options. You say that you want to use certificates, so here goes:
1 In your isakmp policy, you shouldn't need to specify an authentication method, because certificates are the default.
2 If you are using certificates, there are two processes that you need to complete with the CA, the authentication phase (crypto ca authenticate domain.name) and an enrollment phase (crypto ca enroll domain.name) When you complete the first phase, you receive the ca certificate as appears in your key chain, you won't receive your routers own certificate until you complete the enrollment phase.
Like I said, I'm a little concerned that you have a mix of authentication commands on your router. If you are looking at a single point-point encrypted link, then encrypted nonces may be a better option than certificates, as it doesn't require any trust in a third party (the CA)
