We use Terraform to automate the actual generation of the certificates (it checks the expiration date and does a renewal request when you're 30 days away), but

We use Terraform to automate the actual generation of the certificates (it checks the expiration date and does a renewal request when you're 30 days away), but the basic approach we use is to generate the certificate with DNS validation, store it in a known location in S3, and then have the machines download the certificate on startup and refresh as a cronjob.