zones.conf for master looks ok. What about zones.conf for the new satellite?
Empty list for icinga2 ca list is typical for certificate request which are older than 7 days IIRC or not received requests.
The logs tells about valid or unsigned certificates.
BTW: When posting conf files please use code blocks for better readability.