Here's a nice read on stealing user certificates with meterpreter mimikatz extension

Security and Networking - Blog - Stealing User Certificates with Meterpreter Mimikatz*Extension