How do you manage certificates mapped to user accounts in Active Directory?

Admin folks, can you tell us how do you manage certificates mapped to user accounts in the AD? Tips, please. Do you use any tool like ManageEngine Key Manager Plus or anything else?