fix ACM DomainValidationOptions to support waiters
diff --git a/localstack/services/acm/provider.py b/localstack/services/acm/provider.py
index ecc5d75694bd1..2f3c45c637f18 100644
--- a/localstack/services/acm/provider.py
+++ b/localstack/services/acm/provider.py
@@ -20,9 +20,7 @@ def describe(describe_orig, self):
         "ExtendedKeyUsages": [],
         "Options": {"CertificateTransparencyLoggingPreference": "ENABLED"},
     }
-    addenda["DomainValidationOptions"] = options = (
-        getattr(self, "domain_validation_options", None) or []
-    )
+    addenda["DomainValidationOptions"] = options = cert.get("DomainValidationOptions")
     if not options:
         options = addenda["DomainValidationOptions"] = [
             {"ValidationMethod": cert.get("ValidationMethod")}
diff --git a/tests/integration/fixtures.py b/tests/integration/fixtures.py
index 726cd3e0f2f3b..e79b4416bbdda 100644
--- a/tests/integration/fixtures.py
+++ b/tests/integration/fixtures.py
@@ -710,6 +710,29 @@ def _create_parameter(**kwargs):
         secretsmanager_client.delete_secret(SecretId=item)
 
 
+@pytest.fixture
+def acm_request_certificate(acm_client):
+    certificate_arns = []
+
+    def factory(**kwargs) -> str:
+        if "DomainName" not in kwargs:
+            kwargs["DomainName"] = f"test-domain-{short_uid()}.localhost.localstack.cloud"
+
+        response = acm_client.request_certificate(**kwargs)
+        created_certificate_arn = response["CertificateArn"]
+        certificate_arns.append(created_certificate_arn)
+        return created_certificate_arn
+
+    yield factory
+
+    # cleanup
+    for certificate_arn in certificate_arns:
+        try:
+            acm_client.delete_certificate(CertificateArn=certificate_arn)
+        except Exception as e:
+            LOG.debug("error cleaning up certificate %s: %s", certificate_arn, e)
+
+
 only_localstack = pytest.mark.skipif(
     os.environ.get("TEST_TARGET") == "AWS_CLOUD",
     reason="test only applicable if run against localstack",
diff --git a/tests/integration/test_acm.py b/tests/integration/test_acm.py
index 7d66f1fea6ee4..3e4f86df170ba 100644
--- a/tests/integration/test_acm.py
+++ b/tests/integration/test_acm.py
@@ -1,10 +1,8 @@
-import unittest
-
+import pytest
 from moto.ec2 import utils as ec2_utils
 
 from localstack.constants import TEST_AWS_ACCOUNT_ID
 from localstack.utils.aws import aws_stack
-from localstack.utils.common import short_uid
 
 DIGICERT_ROOT_CERT = """
 -----BEGIN CERTIFICATE-----
@@ -25,37 +23,41 @@
 """
 
 
-class TestACM(unittest.TestCase):
-    def test_import_certificate(self):
-        acm = aws_stack.create_external_boto_client("acm")
-
-        certs_before = acm.list_certificates().get("CertificateSummaryList", [])
+class TestACM:
+    def test_import_certificate(self, acm_client):
+        certs_before = acm_client.list_certificates().get("CertificateSummaryList", [])
 
-        with self.assertRaises(Exception) as ctx:
-            acm.import_certificate(Certificate=b"CERT123", PrivateKey=b"KEY123")
-        self.assertIn("PEM", str(ctx.exception))
+        with pytest.raises(Exception) as exec_info:
+            acm_client.import_certificate(Certificate=b"CERT123", PrivateKey=b"KEY123")
+        assert "PEM" in str(exec_info)
 
         private_key = ec2_utils.random_key_pair()["material"]
-        result = acm.import_certificate(Certificate=DIGICERT_ROOT_CERT, PrivateKey=private_key)
-        self.assertIn("CertificateArn", result)
-
-        expected_arn = "arn:aws:acm:{0}:{1}:certificate".format(
-            aws_stack.get_region(), TEST_AWS_ACCOUNT_ID
-        )
-        acm_cert_arn = result["CertificateArn"].split("/")[0]
-        self.assertEqual(expected_arn, acm_cert_arn)
-
-        certs_after = acm.list_certificates().get("CertificateSummaryList", [])
-        self.assertEqual(len(certs_before) + 1, len(certs_after))
-
-    def test_domain_validation(self):
-        acm = aws_stack.create_external_boto_client("acm")
-
-        domain_name = "example-%s.com" % short_uid()
-        options = [{"DomainName": domain_name, "ValidationDomain": domain_name}]
-        result = acm.request_certificate(DomainName=domain_name, DomainValidationOptions=options)
-        self.assertIn("CertificateArn", result)
-
-        result = acm.describe_certificate(CertificateArn=result["CertificateArn"])
+        result = None
+        try:
+            result = acm_client.import_certificate(
+                Certificate=DIGICERT_ROOT_CERT, PrivateKey=private_key
+            )
+            assert "CertificateArn" in result
+
+            expected_arn = "arn:aws:acm:{0}:{1}:certificate".format(
+                aws_stack.get_region(), TEST_AWS_ACCOUNT_ID
+            )
+            acm_cert_arn = result["CertificateArn"].split("/")[0]
+            assert expected_arn == acm_cert_arn
+
+            certs_after = acm_client.list_certificates().get("CertificateSummaryList", [])
+            assert len(certs_before) + 1 == len(certs_after)
+        finally:
+            if result is not None:
+                acm_client.delete_certificate(CertificateArn=result["CertificateArn"])
+
+    def test_domain_validation(self, acm_client, acm_request_certificate):
+        certificate_arn = acm_request_certificate()
+        result = acm_client.describe_certificate(CertificateArn=certificate_arn)
         options = result["Certificate"]["DomainValidationOptions"]
-        self.assertEqual(1, len(options))
+        assert len(options) == 1
+
+    def test_boto_wait_for_certificate_validation(self, acm_client, acm_request_certificate):
+        certificate_arn = acm_request_certificate()
+        waiter = acm_client.get_waiter("certificate_validated")
+        waiter.wait(CertificateArn=certificate_arn, WaiterConfig={"Delay": 0, "MaxAttempts": 1})

Fixes the `DomainValidationOptions` for ACM's `DescribeCertificate` operation.
The previous implementation did not use the existing array of the cert in the CertBundle, but tried to resolve a non-existing attribute, which in the end wasn't set (since the `addenda` would only be used for non-existing keys in the result).

This fix is necessary to fix the ACM waiter on `certificate-validation`, which can be executed with awscli / awscli-local:
```
$ awslocal awslocal acm request-certificate --domain-name test-domain.localhost.localstack.cloud
{
    "CertificateArn": "arn:aws:acm:us-east-1:000000000000:certificate/1547a44e-8ff9-4ee3-92f3-7e0f2bcf9b74"
}
$ awslocal acm wait certificate-validated --certificate-arn "arn:aws:acm:us-east-1:000000000000:certificate/1547a44e-8ff9-4ee3-92f3-7e0f2bcf9b74"
```
Without this fix, the latter call would not be successful (because the `DomainValidationOptions` of `DescribeCertificate` would never state that the `ValidationStatus` is `SUCCESSFUL`). 
The same mechanism is used when creating a `DnsValidatedCertificate` with CDK.