The only way we could get it to work was to install the Windows Certificate Server web server on our certificate authority. Each user on a Mac would have to run the certificate wizard in the keychain to create a certificate request and then submit it through the Windows certificate server. It's not ideal, but it works.
Also, just a heads up that using MacOS certificates and AnyConnect is broken on 17.10.2. We are working with support and are stuck on 16.16.3 right now.