Use the TLScertFile option inside the virtual host. The one in the binding will be the default, in case the IP address or some unknown hostname is used in the Host header. If one of the three known hostnames is used, the one from the virtual host record is used.
Binding {
...
TLScertFile = /some/path/default.pem
}
VirtualHost {
Hostname = www.example.com
...
TLScertFile = /some/path/example.com.pem
}
...