That's not quite right. You must provision your CloudFront certificate in us-east-1 because that's where CloudFront is. You can provision ACM certs in any region.

I have ACM certs issued and working in ap-northeast-1 and us-west-2, attached to an ALB.

That is the case for Cloudfront certificates globally. For Loadbalancer or other uses, you should just provision your certs in your own region.