Is it possible to extract the certificate from a CAC (DOD common access card) and install it on a phone so that access to websites using bidirectional SSL can be done from a user phone. Ideally, the certificate would still be protected by a PIN/passphrase. Initially interested in Android phones.
The CAC seems to be a typical smartcard where the private key is stored on the card itself and crypto operations involving the private key like signing are also done on the card. Such smartcards do not allow extraction of the private key. In fact, that is the main purpose of these cards that any use of the private key should explicitly require physical possession of the smartcard.
In other words: you will not be able to extract the necessary secrets (private key of the certificate) from the card so that you can use these to authenticate yourself without the physical card being involved.
As @Steffen says, unless there's some horrible vulnerability with the CAC card, you shouldn't be able to extract the private key from an existing card. That's kind of the whole point of those things.
That said, at card creation time, you could load the same private key into a physical CAC card and into the Android device (assuming that your department policy will allow it), or simply have two CAC cards registered to you, one physical and one in an app.
As an example, the Entrust Mobile Smart Credential mobile app emulates being a smart card either to a laptop over USB / bluetooth, or to a door reader over NFC. If your IT department supports a solution like that, maybe something like that might address your needs?
Disclaimer: I work for Entrust and I do not have any experience with another app that might do the same thing.