Unfortunately, there really isn't a way to do this. But there are two kinds of certificates.
Those installed with operating systems and applications such as VPN tokens.
Those uniquely tied to passwords stored on the computer. Most passwords you can reset with the owner authority of the password directly.
The Keychain Access utility in Applications -> Utilities lets you rebuild keychains, and that includes certificates once the current admin is established.
A mobile account user that is tied to Active Directory on a Mac may end up having their password changed on active directory, and find themselves logging in with the notification to update the keychain. You will need the older password you used to login the Mac before the last active directory change to avoid losing passwords in the certificates.
Any certificates you can't find otherwise, you'll need to reinstall either by reinstalling the application that owned them, or the operating system in question.
Apple provides combo updates to update the latest security for each upgrade, as well as security updates.
If we know what the certificate belonged to, we can recommend what to install.