You can store the cert and key in a key/val store and each EC2 server would only need to renew the cert.