<p>I have a site, foo.com, that makes ajax requests to bar.foo.com. Will this work.</p>

<p>Also, if foo is a secure connection, https, does bar.foo.com need to be https too? Can these two sites use different certificates?</p>

Most browsers will, depending on their security/privacy setting, block any outside call made - and only allow AJAX calls made to the same domain. Even subdomains are blocked, because on shared environments they might pose a real threat.
In short: only make AJAX calls through the same domain (perhaps call a page, that in turn calls another page from another domain - through curl/fopen/...), or you'll run into troubles. That also answers your SSL question - it doesn't matter what SSL you're using, or whether they're the same - calls will get blocked, despite the SSL.