Anyconnect uses one certificate for authentication.
By default is going to look in all the certification stores, but you can set it up to look in the machine or user cert store.
You can also let the users select the certificate using the disable automatic cert selection option in the xml.
For more details on how the ASA searches for the certificate have a look at Configure Which Certificate Stores to Use section:
https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Administrator_Guide_4-0/configure-vpn.html#ID-1428-00000555
I believe the identity certificate and the immediate intermediate CA certificate need to in the same trustpoint.
You can control the certificate used for ssl vpn on the asa with: ssl trust-point Trustpoint OUTSIDE
HTH
Bogdan
