Thanks Mone for the quick reply, that document is really useful, we are leveraging LB stickiness so option 2.1.A applies and as such it seems we only need the one ssl cert for parent domain. It will save some money and time requesting unnecessary certs.