Reading through their docs, it seems cert-manager should support this, but unfortunately it wasn't available in our cluster. I'll see if there is any reason we couldn't add it.