Amazon Certificate Manager issues publicly-trusted certificates, so they have to abide by the validation rules mandated by the Baseline Requirements, which do n

Amazon Certificate Manager issues publicly-trusted certificates, so they have to abide by the validation rules mandated by the Baseline Requirements, which do not permit what you desire. CAs have often sought to bypass domain or CAA validation for domains which they believe are hosted with them, and this has repeatedly proven to be a bad idea because it relies on the CA to maintain accurate records about what domains are hosted with them. The source of truth for this information is in the public DNS, so it's more robust to require CAs to check public DNS records. See for example the now-forbidden DNS Operator Exemption to CAA, which I advocated to be banned after Microsoft bypassed CAA checking for domains which they thought they controlled but really didn't: https://groups.google.com/g/mozilla.dev.security.policy/c/0TfT9BziQVc https://groups.google.com/g/mozilla.dev.security.policy/c/0T... If your domains don't otherwise have public DNS records, maybe you should be using private certificates instead of publicly-trusted ones?