+1 for Az KeyVault.
I use it in my Docker deployment scripts using Azure CLI. Example here is a secret, but similar concept for certs using CLI:
STORAGE_ACCOUNT_KEY=`az keyvault secret show --vault-name=<your keyvault> --name=<secret name> --query=value | tr -d "\""`
This populates a .env file, referenced in Docker-compose.yml.
+1, the integration to supplant K8 secrets is very nice.