Host a copy of cloudfront distribution for AWS Identity Center "access portal" application?

I'd like to host a copy of the AWS Access Portal on something like "awssso.mydomain.com" (not the "burn the name forever" mydomain.awsapps.com domain).

Of course "the simplest thing that could have worked" does not: I tried creating a cname for "awssso.mydomain.com" -> "d-12345678@awsapps.com". The server's SSL certificate raises the brower's alert AND the webapp itself is broken when the navigator location does not match any SANs on the certificate.

But also I have worked with AWS customers, enterprises that do host their own "copy" of the AWS Access Portal webapp within theirdomain.com (outside awsapps.com). This seems to be undocumented, I wonder how I could do the same? It's just a cloudfront distro, assembled from the assets built by an Angular.js app, right? How can I get a copy of that?