It's used extensively in finance from what I've seen. Not personal or even business banking, but trading, investment portfolio management, financial advisors, those sorts of area. Everyone is given a certificate they install, and that's to identify them.

I've also used it in client-server applications, not on the web, and it was very effective as a transport layer security mechanism, but in that case it was devices talking to devices in an automated way, so there was never a problem with user experience or education of users.