One certificate per IP.

Whether the from SNI or the cert itself, there could be a lot of info to be learned about what the user was trying to access.