Route 53

When requesting an ACM certificate, AWS will ask you to add some CNAME records in Route 53 (or your DNS provider if not using Route 53) to prove you own the domain.

Route 53, for whatever reason, may not actually let you add the records: it will view the "_eldritchhorror" names for the CNAME records as invalid. For even weirder reasons, if you add the records as TXT records and then edit them to be CNAME records, it has no complaints. So do that.