This cannot be reliably done with Windows XP in the wild.

http://en.wikipedia.org/wiki/Server_Name_Indication

Essentially, the cloudfront server doesn't know the certificate to present.