+1 for Az KeyVault.
I use it in my Docker deployment scripts using Azure CLI. Example here is a secret, but similar concept for certs using CLI:
STORAGE_ACCOUNT_KEY=`az keyvault secret show --vault-name=<your keyvault> --name=<secret name> --query=value | tr -d "\""`
This populates a .env file, referenced in Docker-compose.yml.
Worth noting accessible using api via REST https://docs.microsoft.com/en-us/rest/api/keyvault/
and powershell https://docs.microsoft.com/en-us/azure/key-vault/secrets/qui...