Some good practises to consider:
Create unique, hard to guess certificate keys
Keys should be hard to guess even if that means that they're also harder to type. You may wish to consider random.org to generate true random alphanumeric keys using their HTTP api. The site seeds the pseudo-random string generation algorithms that programming languages use with atmospheric noise, which is said to generate less guessable 'random' numbers.
There are other ways to generate truly random codes using hardware random number generators.
Secure the gift card claims process
Do all you can to prevent brute force attacks against the forms that process your gift card codes.
You don't want to give attackers an easy method to test generated keys, so limit the number of gift code claim attempts by time, IP address, and user account, and force users to be registered and logged in to attempt a claim. It's easier to block access by user account than it is by IP band.
Consider linking certificate codes to an email address or account
When your user buys a gift card and you ask them for their friend's email address, check to see if their friend's already registered with you. If they are, link the gift code to the friend's account so that they it can only be claimed by that user.
Alternatively, credit the friend's account directly rather than generating a key code and send them an email to confirm that their account's been credited (without requiring them to sign in and input a gift code). It's hard to crack gift codes when they don't exist. If the friend doesn't have an account, invite them to sign up with a registration link that pre-fills their email address, then credit their account with the gift amount when they've completed sign up. Again, the idea is to remove the dependence on gift codes.
Consider expiring gift cards after a fixed period
Flickr does this with their gift accounts; if the gifted account code is not used within 24 months, the gift amount is credited back to the purchaser. It prevents hundreds of dormant codes lying around on the system that could get matched against a guessed code.
Use an activation process for physical gift certificates
Codes will be preprinted (and masked using a foil), but they should remain inactive until after the point of sale. iTunes gift voucher cards are activated at the tills, for example, which makes them far less attractive to shoplifters.
Secure the email delivery system
Send transactional email containing voucher codes through mailservers that only you use, and only you can access. Consider deleting all copies of outgoing mail that may be stored on that server by default.
Track claimed codes and render them unusable
Naturally, track claimed codes and mark them as so to ensure they're not reused.
Lock down your servers, then create and follow a security policy
Use good passwords, patch your server software, issue and claim codes only over HTTPS, and write and adhere to a sensible security policy. Making your gift card system bulletproof is a waste of time if the systems it depends on are vulnerable.