code: def acm_certificate_arn(self, lookup, default=None):
      
      # @todo: Only searches the first 100 certificates in the account
  
      try:
        # This a region-specific client, so we'll make a new client in the right place using existing SESSION
        region_name, domain_name = lookup.split("/")
        acm_client = EFAwsResolver.__CLIENTS["SESSION"].client(service_name="acm", region_name=region_name)
        response = acm_client.list_certificates(
          CertificateStatuses=['ISSUED'],
          MaxItems=100
        )
      except Exception:
        return default
      # No certificates
      if len(response["CertificateSummaryList"]) < 1:
        return default
      # One or more certificates - find cert with latest IssuedAt date or an arbitrary cert if none are dated
      best_match_cert = None
      for cert_handle in response["CertificateSummaryList"]:
        if cert_handle["DomainName"] == domain_name:
          cert = acm_client.describe_certificate(CertificateArn=cert_handle["CertificateArn"])["Certificate"]
          # Patch up cert if there is no IssuedAt (i.e. cert was not issued by Amazon)
          if not cert.has_key("IssuedAt"):
            cert[u"IssuedAt"] = datetime.datetime(1970, 1, 1, 0, 0)
          if best_match_cert is None:
            best_match_cert = cert
          elif cert["IssuedAt"] > best_match_cert["IssuedAt"]:
            best_match_cert = cert
      if best_match_cert is not None:
        return best_match_cert["CertificateArn"]
      return default
docs: Args:
        lookup: region/domain on the certificate to be looked up
        default: the optional value to return if lookup failed; returns None if not set
      Returns:
        ARN of a certificate with status "Issued" for the region/domain, if found, or default/None if no match
        If more than one "Issued" certificate matches the region/domain:
          - if any matching cert was issued by Amazon, returns ARN of certificate with most recent IssuedAt timestamp
          - if no certs were issued by Amazon, returns ARN of an arbitrary matching certificate
          - certificates issued by Amazon take precedence over certificates not issued by Amazon