Request the certificate in the Region of the service that uses it (us-east-1 for any CloudFront distribution) and validate by DNS. Then leave the validation CNAME in place forever: ACM renews automatically for as long as the certificate is in use and the record exists.

Which Region

Used by	Certificate Region
CloudFront (viewer HTTPS)	us-east-1, whatever Region the origin is in
ALB / NLB listeners	The load balancer's Region. To use the same names with ELB in several Regions, request a certificate in each; certificates can't be copied between Regions
CloudFront → an ELB origin over HTTPS	The ELB's certificate can be in any Region (it is the ELB's own)

Each Region's request is validated on its own (the Regions page says you must revalidate each name per Region). The DNS validation token is the same in every Region, though, so a CNAME you already published satisfies the new request, for example the us-east-1 copy CloudFront needs.

DNS validation

ACM gives one CNAME per name: _<x>.example.com. → _<y>.acm-validations.aws.. A wildcard (*.example.com) shares the record of its base domain. Add it once:

Route 53: the ACM console offers Create records in Route 53. It shows when you can write to the hosted zone and the name isn't yet validated. ACM can't create the record through its own API; create it yourself with Route 53's ChangeResourceRecordSets (reference/route53/records-and-changes.md).
Another DNS provider: enter the name and value. Many providers append the domain automatically: enter only _<x>, or the record becomes _<x>.example.com.example.com. and validation fails.

After the record is in place, the status can stay Pending validation for up to 30 minutes.

Statuses and failures

Situation	Cause → fix	Check
Pending validation for hours	The CNAME is missing, has the wrong name (double domain), or the DNS provider isn't authoritative for the domain (check the registrar's name servers). Listeners and distributions can't use the certificate yet	`aws acm describe-certificate --certificate-arn <c> --region <r> --query Certificate.DomainValidationOptions[].[ValidationStatus,ResourceRecord]`, then `dig <ResourceRecord.Name> CNAME +short`
Validation timed out	Not validated within 72 hours of ACM generating the CNAME. Request a new certificate	`aws acm describe-certificate --certificate-arn <c> --region <r> --query Certificate.Status` → `VALIDATION_TIMED_OUT`
Validation fails through long CNAME chains	More than five chained CNAMEs breaks resolution. Use email validation	`dig <name> CNAME` repeatedly, counting the hops
A provider rejects names starting with `_`	See ACM's DNS-validation troubleshooting page (not collected)	The provider's record form rejects the name
Certificate created with email validation	It can't be switched to DNS. Delete and request again with DNS	`aws acm describe-certificate --certificate-arn <c> --region <r> --query 'Certificate.DomainValidationOptions[].ValidationMethod'`
No authority over the domain's DNS	Use email validation	`dig <apex> NS +short` vs the provider you can edit
Renewal stopped	The certificate is no longer attached to an AWS service, or the CNAME was deleted. Both stop automatic renewal	`aws acm describe-certificate --certificate-arn <c> --region <r> --query 'Certificate.[InUseBy,RenewalEligibility,RenewalSummary]'`

Name coverage (the browser errors)

Every name clients use must be in the certificate's SAN, exactly or by a wildcard at the same level (*.example.com covers www.example.com, not a.b.example.com, and not example.com itself unless listed).
A load balancer's default …amazonaws.com DNS name can't be on a public certificate. Clients must use your own name, or see NET::ERR_CERT_COMMON_NAME_INVALID.
CloudFront checks that each alternate domain name is covered by the attached certificate before accepting it.

Keys and imported certificates

ACM issues RSA keys up to 2048 bits. CloudFront also accepts imported RSA keys up to 4096 bits, and ECDSA P-256 and P-384. Imported certificates aren't renewed by ACM. Re-import at least 24 hours before NotAfter, because CloudFront can take up to 24 hours to pick up the change.