Q1: If you have 3 different machines composing a site do they all have to have the same certificate, or simply be SSL?
A1: The only way that applying the same certificate to multiple GIS Server machines in a site could be supported would be if the machines in the site share a domain and you use a wildcard certificate.
If you request a certificate to have a CN and SAN like *.xyzdomain.com, you may apply that certificate to multiple GIS Server machines in a site, assuming all those machines are on the same domain. You would not want to get a certificate with a CN for machine-A.xyzdomain.com and apply this certificate to machine-B.xyzdomain.com.
Q2: If each machine in a site has to have the same cert, does the web adapter machine also have to have that same cert?
A2: No. Certificates are applied at the web server level, not the machine level. A machine may have multiple web servers. For instance, I can run ArcGIS Server and IIS on the same machine. Those web servers cannot share the same ports, though. Customers can and do use self signed certs at the GIS Server tier and CA signed certs at the web tier.
Q3: If I have a web adapter on machine A pointing at the site, and another adapter on machine B pointing at the same site does it matter? It seems like the Web Adapter machines have to be SSL enabled but the certs can be different than the site, and machines in it.
A3. That's correct. I might have a CA signed certificate on a web server with a CN defined as www.randall.com. Then, I might open port 6443 on my firewall and register the web adaptor with a machine inside my local domain called machineA.xyzdomain.com. I may also install the web adaptor on an internal facing web server and configure it to point to my GIS Server site. In this case, I could potentially have three different certificates - one at the web tier with the external facing web adaptor, one on the internal web server, and one on the GIS Server.
