AWS::CertificateManager::Certificate (DNS validation) fails with InternalFailure "Connection pool shut down" since ~2026-06-09 (eu-central-1)

**Resource type:** `AWS::CertificateManager::Certificate`
**Region:** eu-central-1
**Since:** ~2026-06-09

Since 2026-06-09, every CloudFormation create of a **DNS-validated** ACM certificate in eu-central-1 fails for us with:

```
Resource handler returned message: "Connection pool shut down" (HandlerErrorCode: InternalFailure)
```

Failure rate ~15/17 across two days, including 4/4 controlled single-resource test stacks. **Email-validated certs are unaffected** (4/4 clean).

The failure is machine-regular: `CREATE_IN_PROGRESS` → `Eventual consistency check initiated` (+0.5s) → handler logs the computed validation record (+31s) → `CREATE_FAILED` (+31.2s). CloudTrail shows `RequestCertificate` succeeds and **no `route53:ChangeResourceRecordSets` is ever attempted** — the handler computes the validation CNAME, then crashes on an already-closed HTTP client.

Notably, the `Eventual consistency check initiated` stack event **never appeared before 2026-06-09** in any of our cert deploys (dozens since April, all clean) — it arrived together with the failures, which looks like the per-type "optimistic stabilization" handler update being enabled for this resource type. Hosted-zone age/delegation is irrelevant (settled and fresh zones fail identically). Roughly 1 in 8 invocations survives.

Sample failed RequestTokens (2026-06-09/10, eu-central-1): `5413b4ae-4037-bf8c-1da4-e544e4a3fd6a`, `3c700d2e-83f1-bc88-0aaa-712b359ffcb9`, `0c754653-86d6-157e-3368-e5cee9c6e0db`, `7b5a297e-109d-31fe-ff76-e2893112f86d`

Can AWS confirm a handler update for `AWS::CertificateManager::Certificate` around 2026-06-09 and roll back/fix the DNS-validation path?

Workaround we're using: pre-create certs via the ACM API and reference with `Certificate.fromCertificateArn`.

No repository file, test, or entry point is named. Start by reviewing the supplied eu-central-1 reproduction, timing, CloudTrail evidence, and ACM API workaround; done would require AWS to confirm or correct the Certificate DNS-validation handler, rather than a change in this repository.

Written by the indexing model from the issue text.