I am having issues as well:
CACNG
SCR3500 reader
OS X 10.12.2
Centrify 5.3.3
If I unlock the Keychain via Outlook everything works fine there reading and sending S/MIME, but if, while the card is unlocked in Keychain, I try to access a CAC-protected website via Chrome or Safari it fails with SSL private key not found errors. If I then manually lock the CAC in Keychain and try again in Chrome/Safari they prompt for my CAC pin and everything works fine.
I think there is a conflict between Keychain Access and WebKit networking: if Keychain has the CAC unlocked then WebKit networking cannot use it and vice-versa. Not sure this is a Centrify or OS X issue.