Lumen Analytics runs several public-facing ALBs across multiple Regions. Their ACM public certificates use email validation and renewals often fail due to quarantined emails, causing outages. They want fully automated certificate renewal and deployment to ALBs with no manual steps. What should they do?

The correct option is to request new ACM public certificates using DNS validation because it fully automates renewal and deployment to ALBs without manual intervention. DNS validation involves placing CNAME records in Route 53, allowing ACM to automatically validate domain ownership and renew certificates. This eliminates the problem of quarantined validation emails. The other options are incorrect because: continuing email validation with SES still relies on email, which can be unreliable; ACM Private CA is for private certificates, not public-facing ones; and generating CSRs with OpenSSL and using a Lambda function introduces manual steps and complexity that ACM's integrated solution avoids.