https://code.facebook.com/posts/365787980419535/scalable-and...
If you're in AWS, you can also look at Bless, which is Lambda-hosted and mints short-lived certificates with a command-line client:
This does not work for interactive terminal use cases, but does work (in my experience) if you’re targeting immutable instances. It also has the lovely side effect that you can create scheduled tasks within the AWS control plane (if that’s your cup of tea).
Example SSM client: https://github.com/itsdalmo/ssm-sh
Disclaimer: I’m implementing this in a large enterprise environment.