How do I use SSL with Amazon S3 CNAME masked buckets?

you need to pay for cloudfront+ssl in order for that to work. There is no way you can serve a s3 bucket wiith your own domain.

You can use amazon's https host for your bucket though and that would work.