Hi Sim;

  Yes, you'll need both a Server & Client certificate. Normally, they would come as a "matched" pair.

   I would suggest soliciting your organization's Web Server support team for further help.

Regards ... Chris

It will depend on whether your certificate is Single Domain, or Wildcard Domain/Multi-domain.

Essentially, if the provider only gives you Single Domain Certificates, you will need two certificates, one for each domain under which you plan to put the Cloud App and the Web API.

If you are provided a Wildcard Domain, you can use the same certificate for both sites provided they are on the same domain. For example, if the certificate is valid for *.yourdomain.com then it would be valid for both yourdomain.com and api.yourdomain.com.

Please refer to this ServerFault post for more details: https://serverfault.com/a/566433

Regards,
Francisco