I just got off a 2 hour support call to AWS. I am facing a similar scenario: white-label multi-tenant social network platform, need to handle multiple externally mapped domains and SSL. Their recommendation was as you outlined: generate multiple SSL certs along with multiple CloudFront distros. Naturally leading to an outcome of say 1000 customers equals 1000 ACM certs and 1000 CloudFront distributions pointing to the same S3 bucket (sheesh invalidating cache should be fun). FYI i had to request the limit for both be increased.
I also came across traefik.io which looks to have auto SSL handling. I guess if this were easy everyone would be doing it haha.
devpascoe