PLEASE NOTE THE EDITS & UPDATES BELOW
As of me writing this (May 23 2012), SSL is supported via the CloudFront distribution URL
only. Meaning, you cannot CNAME the SSL URL. Concretely, you can reference an item via SSL as:
where cdn.mydomain.com is a CNAME to [distribution].cloudfront.net. At present you will get SSL errors.
This means you are unable to use your domain name or SSL cert. This can cause problems with crossdomain policies in the browser as well as add undo complexity to the maintenance of a site.
I have been assured by AWS staff that HTTPS support for distribution CNAMEs is on their feature list but that it needs community support for prioritization. To help in this effort please fill out the CloudFront survey (see below) and note this feature request. AWS staff use data gathered from the survey for planning and prioritizing the CloudFront roadmap.
Be sure to note that HTTPS CNAME support is needed when you take the CloudFront Survey: http://aws.qualtrics.com/SE/?SID=SV_9yvAN5PK8abJIFK
EDIT: Noticed a post from June 11, 2012 that AWS had updated the survey link:
New Survey Link: http://aws.qualtrics.com/SE/?SID=SV_e4eM1cRblPaccFS
I think it is worth the time to provide them feedback about making CNAME + SSL a supported feature.
EDIT: Announced on June 11, 2013, custom SSL Certs with dedicated IPS are now supported with CloudFront on AWS:
See the feature announcement on the AWS Blog: http://aws.typepad.com/aws/2013/06/custom-ssl-domain-names-root-domain-hosting-for-amazon-cloudfront.html
One item of consideration before counting on going this route, you need to see significant value from deviating from the https://[distribution].cloudfront.net route as the pricing is $600 USD per month for hosting custom SSL certs.
EDIT: Announced on March 5, 2014, custom SSL Certs using Server Name Indication (SNI) are now supported with CloudFront on AWS -- NO ADDITIONAL CHARGE:
AWS now supports custom SSL Certs via SNI. This is HUGE as it opens the possibility of leveraging AWS' existing infrastructure (IP addresses). As such, AWS does not charge extra for this service! To learn more, read about it on the AWS blog post: http://aws.typepad.com/aws/2014/03/server-name-indication-sni-and-http-redirection-for-amazon-cloudfront.html
One item that should be noted though, Server Name Indication (SNI) does have some drawbacks that should be considered before relying on it completely. In particular it is not supported by some older browsers. If want to understand this better, see: http://stackoverflow.com/questions/5154596/is-ssl-sni-actually-used-and-supported-in-browsers