You likely can't do it easily with only CName.
All CNAME does is directs packets to be routed to your server. Once there, two issues arise:
1. How does apache know which site on your server is the right site? Without a header with your domain name in it apache doesn't know, it can only send the request to the first domain set up for that IP#. To overcome this hurdle your subdomain (not the main domain but the subdomain) must be the first domain listed for it's IP#. The easiest way to do that is to set up the subdomain as if it were a main domain, and give it it's own IP#.
2. Once apache knows which site (in other words, hich public_html diretory on your server) gets the request, your shopping cart software must know that his domain name is a valid domain name for that shopping cart. If your shopping cart cares, then you may not be able to do this anyway. If it doesn're care then you may e able to do this, but any domain-based links in the shopping cart will still show the domain name on your server in the visitor's browser. If the shopping cart is built with dynamic links, then they may work, except if there are any links from the shopping cart go between http and https, as such cross-protocol links must be specific links with protocol, so they'll always be to your domain.
3. All else above okay? Does your shopping cart have a secure Certificate to present pages securely (https vs http)? If so, you'll need to replace your Certificate with a multi-domain certificate. Perhaps at significant additional cost.
Some shopping carts may be designed for this kind of linking, but as you can see above, there are a bunch of hurdles to go thrugh.
Jeff