@galaxis I've been using dehydrated https://github.com/lukas2511/dehydrated  which is a bash implementation.  There are various "hooks" that you can use to restart services and copy/chmod/chown etc  keys/certs post issuing. 
https://github.com/lukas2511/dehydrated/blob/master/docs/examples/hook.sh