Apache virtual hosts with multiple domains

Lots of questions there! Let's try to work through them:

1. Not sure what you are asking here, and not an expert in CNAMES but would have thought you'd need '*.domain1.com' at least instead of just '*'

2. For both you fails you do not explicitly note your alternative server names in either ServerName nor ServerAlias. In this case it will default to the first server found in the config. Is this the api.domain.com one? If so that might explain the 404 as the SERVER_NAME will (by default) be the client supplied one so the api.domain1.com:80 settings will just redirect to the https version of what they sent (which is what appears to be happening), which will then also look at the api.domain1.com:443 config and not find the name. You would need to either add the alternative names to ServerAlias setting of your main domain1.com config, or move that config to be first so it becomes the default and the api one is only used when the api.domain1.com name is explicitly used.

3. As you appear to want to redirect this straight to your new site I would update the DNS to point to your new IP address, to save you paying for two servers (in terms of money and time to administer). This can be done on the existing DNS nameserver to keep the e-mail though obviously would be nicer to consolidate on one. In the meantime implement a proper 301 redirect in the server config as the meta redirect is not as strong a signal to search engines and you do seem to care about SEO.

4. The main way is to redirect http to https. HSTS is primarily a security feature which automatically redirects http to https before the browser makes the request. This is useful as the default is http (e.g. typing www.example.com in the browser address bar will, by default, send you to http://www.example.com rather than https://www.example.com), and this can be intercepted to prevent an upgrade to https (which is more difficult to then intercept). It has some downsides though: Not all browsers support it, you need to visit the website at least once to load the HSTS setting (though some browsers allow pre-loading of this), and the setting will expire if the site is not visited in the maxAge time (again assuming it's not preloaded). So it should not be used as a replacement to redirects but more as an enforcement of it for browsers that support HSTS. Blogged about it here if you want to read more on HSTS.

I would also say you have several different methods of redirecting (api:80 has Rewrite, domain1:80 has Redirect, domain1:443 has Rewrite - but with a very restrictive and incorrect RewriteCond). Personally I prefer to use one method as it's less confusing but that's a personal matter (Redirect is also slightly faster but Rewrite gives you more power so I prefer that one). So I tend to have config like this:

<VirtualHost *:80>
    #This is the first host so is the default.
    #So although I've specified a ServerName and ServerAlias anything else not specified elsewhere will also end up here.
    ServerName www.domain1.com
    ServerAlias domain1.com

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    #Redirect everything to https:
    RewriteEngine on
    RewriteRule ^(.*)$ https://www.domain1.com$1 [R=301,L]
</VirtualHost>
<VirtualHost *:80>
    ServerName api.domain1.com

    ErrorLog ${APACHE_LOG_DIR}/api.error.log
    CustomLog ${APACHE_LOG_DIR}/api.access.log combined

    #Redirect everything to https:
    RewriteEngine on
    RewriteRule ^(.*)$ https://api.domain1.com$1 [R=301,L]
</VirtualHost>

and then for the 443 I would have this:

<VirtualHost *:443>
    #This is the first host so is the default.
    #So although I've specified a ServerName and ServerAlias anything else not specified elsewhere will also end up here.
    ServerName www.domain1.com
    ServerAlias domain1.com

    ErrorLog ${APACHE_LOG_DIR}/ssl.error.log
    CustomLog ${APACHE_LOG_DIR}/ssl.access.log combined

    #Redirect everything which is not already on the real www domain name to that:
    RewriteEngine on
    RewriteCond %{HTTP_HOST} !www.domain1.com
    RewriteRule ^(.*)$ https://www.domain1.com$1 [R=301,L]

    #all your other 443 config for www.domain1.com

</VirtualHost>
<VirtualHost *:443>
    ServerName api.domain1.com

    ErrorLog ${APACHE_LOG_DIR}/ssl.api.error.log
    CustomLog ${APACHE_LOG_DIR}/ssl.api.access.log combined

    #all your other 443 config for api.domain1.com

</VirtualHost>

Note that I've added different log files for each vhost so it's more obvious which vhost is being hit.

Note also that I redirect anything which is not www.domain1.com rather than your version which only redirected if people typed domain1.com (and which I'm not sure would be used as suspect api.domain1.com config came first).

This will also take care of anyone accessing your website by IP address, or any other name as it will always be redirect to your real www.domain1.com server name. This is easy for http requests, but for https requests they may indeed get a cert error if your cert does not include the servername used.

LetsEncrypt do not support wildcards, but they do allow multiple names on a cert so you can easily get a cert for domain1.com and www.domain1.com and you should as this is generally considered best practice. You could also add any other domains you think might be used. For you api.domain1.com domain you could also add to this same cert, or get a separate cert for that since you have separate config for that (your config above is not clear on which you are doing for that since it looks like same config but not sure if that's a typo or not).

For SEO purposes it is indeed best to only serve your site under one URL and use redirects to enforce that URL and above config will do this. This is to prevent Google thinking you have duplicate content if you server the same content under www.domain1.com/page1.html and https://www.domain1.com/page1.html and https://domain1.com/page1.html and http://000.000.000.001/page1.html ...etc.

A lot covered there but hopefully points you in the right direction.