adding SSL for hosting subdomain only

Primary website (domain name) hosted elsewhere. Order entry pages hosted on
i. The primary site recently added ssl, but the order.xyz.com (Apache
webserver) on i not set up for ssl. Do i need the certificate from primary
site? They are as clueless as i am about this, but googling about
subdomains seems to say yes.

DCM long ago set up and has entries needed for sftp.

A second question - since subdomain site has many pages, all dynamic, has
anyone used the Apache rewrite engine so as to not fix every http reference
into https?

Jim