Why is SSH server looking for a public key if it should use the CA certificate to validate the client certificate?

There isn't enough details to be sure what the issue is. The server still uses the public with in the cert for part of the authentication, so the messages don't indicate that its necessarily NOT doing cert auth.

You must configure a public key authentication with a nested authentication with the appropriate certificate selectors. Please update your ssh-server-config.xml following the example below, restart the server then try again.

<authentication-methods>
<!-- BEGIN Cert authentication -->
  <!-- Cert authentication requires the public key method -->
  <authentication name="pub_auth" action="allow">
    <auth-publickey />

    <!-- Cert authentication also requires a sub method with a selector to validate the cert-->
    <authentication name="cert_auth" action="allow">
      <selector>
          <certificate field="subject-name" pattern="??????" />
       </selector>
    </authentication>

    <authentication name="deny_rest" action="deny" />
  </authentication>
  <!-- END Cert authentication -->

</authentication-methods>

For more information on Cert Authentication please see the link below. http://www.tectia.com/manuals/server-admin/60/userauth-cert.html