SSL Certificate on Load Balancer

1. Your web server has to do all the SSL/TLS processing. It means more load on the web server, but you have full control over the certificates and end-to-end security.

2. Your web server can serve everything as normal web pages, offloading the SSL/TLS processing. Considerably lower load on the web server, but you don't control the certificates yourself any more and break end-to-end security.

In the end it comes down to if you trust the security of the load balancer and the network between load balancer and web server. If not, don't bother. Note that if you are running credit card transactions or something similar there are a some rather strict rules about when you may send the data unencrypted from SSL/TLS offloading to your server. Moving the certificate is not really a security advantage (somebody breaking into your web server is going to get all the data, regardless of if they can steal your certs or not).

Do you have such an overhead from SSL/TLS that you really need to offload it to external hardware?

Typically you can setup the offloading system to only provide SSL/TLS security where it is really needed.

I'd suggest one certificate per site (that way you can easily add a fourth site, or remove one of the existing, without touching the certs of the others).

Whether you want a wildcard for each site, or a multidomain which lists all possible subdomains depends on your setup.

If everything is in one location (EC2), wildcard is probably the cheaper and easier way w/o giving up security.

If you host stuff (for the same domain) in different locations (EC2 and own datacenter), I'd suggest multi-domain certs for every location. That way if one of the locations gets compromised, they cannot impersonate the other location (which would be possible with the wildcard cert or one multidomain listing all services of that domain).