A sub-portal with it's own domain name is actually referred to as a parent portal.
The naming is kind of weird because those other parent portals that exist will all share the same child portals.
www.DefaultInstallPortall.com can have a "child" portal added to it which is in reality just another portal in the system (it doesn't inherit anything from it's "parent"). The reason it is called a child portal is that you access it through a sub-folder of the default portal.
The reason I say all that in relation to the question is that if you have real child portals (they all share the same domain name), then you only need a single SSL certificate.
If they all have their own domain names, then you will need a seperate SSL certificate for each one, and setting them up in IIS will also require multiple IP addresses and websites because you can only have one SSL certificate per IP address / website combination.
If they all share the same domain name like mydomain.com and you add new parent portals with different host names on that same domain like portal1.mydomain.com, and portal2.mydomain.com then you can get something called a wildcard SSL certificate which allows for multiple host names to all use the same SSL certificate. This also means you will be able to configure it on one IP address using one IIS website.
So, if you want to have multiple portals share the same SSL certificate then the best way is to have them all share the same domain, and create new parent portals using unique hostnames.