Related: custom SSL for Cloudfront. It's a real show-stopper that I can't serve Cloudfront over SSL via a CNAME.