How to get Apache2 to securely redirect subdomain to a VM on my server

I’m running Debian 13 (stable) on an AMD64 system.

I’m using wildcard Let’s Encrypt certificates on my server for some services I’m running on it (e.g. nextcloud). This part works. However, I also have a Home Assistant VW running it. Currently I’m using my router to redirect a specific port to that VM’s IP address but this only works for http and not https.

I can’t get a certificate from Let’s Encrypt certbot because it wants port 80 to go to the host. I could, I suppose, temporarily redirect all port 80 traffic to the VM to get the certificate then continue use the specific port to access the VM. However, that’s clumsy and also probably means I have to keep doing it every time I want to renew the certificate.

I found an answer to a similar problem https://serverfault.com/questions/749768/http-https-apache-redirect-to-internal-ip-virtual-machine but it’s 10 years old. While it looks like it would allow me to use the wildcard certificates, I can’t get it to work on my server. When I try to access the VM through port 80, I get a 503 error. If I add the port that I use to access the VM to the config, I get a 400: bad request error.

Here’s the virtual host config I am trying (the port # would be added to the proxypass: IP addresses)

<VirtualHost *:80>
    ServerAdmin <my email>
    ServerName ha.<my domain>
    redirect permanent / https://ha.<my domain>/
</VirtualHost>

<VirtualHost *:443>
    # SSL
    SSLEngine on
    SSLProxyEngine on
    SSLCertificateFile /etc/letsencrypt/live/<my domain>/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/<my domain>/privkey.pem
    # Basics
    ServerName ha.<my domain>
    # Proxy
    ProxyPreserveHost On
    ProxyRequests off
    SSLProxyEngine On
    ProxyPass / http://192.168.1.38/
    ProxyPassReverse / http://192.168.1.38/
</VirtualHost>

And yes, I have enabled the site and restarted the Apache2 server.

Any ideas on what is going wrong? Thanks.