Unless you have bought a certificate which has the subdomain as a Subject ALT Name value then yes, otherwise you need a wildcard certificate.
Basic ssl certs for domain.com generally will not support sub.domain.com.
Best practice is probably more a matter of taste, for sake of easy management, it's probably easier to have a wildcard cert or multi-domain certificate. However if one of the domains or machines running the cert gets compromised and you need to revoke the certificate, you have to revoke the whole certificate, not just a single domain. So if this is for a lot of machines this is perhaps not recommended.
Ultimate security of certificates would come down to having different private keys and seperate individual certificates, but for lots of sites this could become a management issue.