I read through some guides on this and I believe it is possible to have apache respond to a subdomain through ssl. I have domain.com responding on 80 and I do not need domain.com responding on 443. Rather, the only use I have for ssl is for the subdomain sub.domain.com.

So my site should be

http://domain.com
http://www.domain.com
https://sub.domain.com
https://www.sub.domain.com

My CNAME records are as follows

  sub.domain.com xxx.xx.xx.xxx
  *.sub.domain.com xxx.xx.xx.xxx

The A record exists but should not matter for the example.

I set up a separate config file in sites-enabled for sub.domain.com

NameVirtualHost xxx.xx.xx.xxx:443

<VirtualHost xxx.xx.xx.xxx:443>
    SSLEngine on
    SSLStrictSNIVHostCheck on
    SSLProtocol -ALL +SSLv3 +TLSv1
    SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:-MEDIUM

    ServerAlias sub.domain.com

    DocumentRoot /usr/local/www/ssl/documents/

    SSLCertificateFile /root/sub.domain.com.crt
    SSLCertificateKeyFile /root/sub.domain.com.key


    Alias /robots.txt /usr/local/www/ssl/documents/robots.txt
    Alias /favicon.ico /usr/local/www/ssl/documents/favicon.ico

    Alias /js/libs /usr/local/www/ssl/documents/js/libs
    Alias /media/ /usr/local/www/documents/media/
    Alias /img/ /usr/local/www/ssl/documents/img/
    Alias /css/ /usr/local/www/ssl/documents/css/

    <Directory /usr/local/www/ssl/documents/>
    Order allow,deny
    Allow from all
    </Directory>

    WSGIDaemonProcess sub.domain.com processes=2 threads=7 display-name=%{GROUP}
    WSGIProcessGroup sub.domain.com

    WSGIScriptAlias / /usr/local/www/wsgi-scripts/script.wsgi

    <Directory /usr/local/www/wsgi-scripts>
    Order allow,deny
    Allow from all
    </Directory>
</VirtualHost>

Now, it is important to mention that https://domain.com responds with what I have running from script.wsgi above instead of on https://sub.domain.com. It does not respond to sub.domain.com. checking https://sub.domain.com causes a 105 error. This is a DNS error but I am convinced the DNS does not have a problem with the CNAME records, they just point to my IP. Am I doing something that Apache can not do?