Almost any decent enterprise identity management solution (read: Active Directory, FreeIPA) includes user certificate management in some fashion; or if you want a separate CA for VPN access it's not hard to write a couple scripts to generate user certificates and revoke them as needed.