Work in progress but: https://github.com/hatstand/gacertsbot/blob/master/appengine...

Currently relies on a fix to the appengine go SDK though: https://github.com/golang/appengine/pull/82

Wait so does this work?

Should do if you manually patch your local SDK.

If you have a Kubernetes cluster you can use https://github.com/PalmStoneGames/kube-cert-manager. Certbot (https://certbot.eff.org/) also has several configurations.