As I’ve explained, where it says
<VirtualHost *:443>
I need it to say
<VirtualHost 1.2.3.4:443>
…because without that, Apache will just serve the same certificate for all domains (the first in the list, I believe). All the existing vhosts have the IP address set (instead of using a wildcard) and work fine.