I used dehydrated pretty effectively (along with openssl) to renew and sync certs between several layers of proxies/loadbalancers. I ended up creating a nice k8s deployment with CronJob to implement this with ingress-nginx.