If it's not an urgent issue ... install analytics now and collect data for a month or two.  You'll also want to install Search Console.  Basically, if the pages have incoming links or traffic you'll obviously want to move them but if not and they're low quality they should probably be left behind.

I assumed I'd be able to deal with it easier too.

If your current site is secure and you want to redirect to the new one then yes, you'll need to keep your SSL cert.  If you don't you'll get a certificate error and the redirection will hit that snag and perhaps worse, the link weight will hit the same one.  Someone linking to the non-https page will redirect but the https will generate the issue. Annoying I know ... now you get to pay for two certificates.

If anyone else knows a way around this I haven't thought of I'd love to hear it but I had to deal with this a few months back and the only solution was to setup the old domain with it's own hosting and certificate and deal with the redirections at that level.

As an irrelevant aside - love that avatar David.

I agree with Mike here.

While technically the canonical might do what you want (kind of) this isn't what it's intended for.  Another side to that coin is, if you funnel the strength to the product page from the PDF but the product page doesn't have the content that the PDF was ranking for then you still won't get the rankings on the product page and on top of that, you'll lose them on the PDFs.