Comment by SoMuchToGrok

Somewhat related: Vault has a PKI backend that can help facilitate this. You'll need to create some tooling around it, but we've had great success rolling it out at my company.

https://vaultproject.io