HTTP redirects happen AFTER the TLS handshake.
For the TLS handshake to be successful, the server has to present a valid certificate, having in it the hostname that is in the URL being accessed, otherwise browsers will show errors.
So the rule is simple: as soon as you see an
https:// URL, even if all accesses to it are finally redirected to another URL, you need a certificate for the hostname in that first URL.
Just to be clearer: it does not need necessarily a separate certificate, as a given certificate can encode multiple hostnames in its "Subject Alternative Names" extension (with some limits defined by CAs, like 100 names at most). It can be debated if it is better to have one certificate per name or one certificate covering all names. There is no clear cut here, as it depends on many factors, like administration of those certificates (and their renewals) and controls of the underlying websites and/or nameservers. A given certificate with all names in it however means the fate of all websites is shared: if that certificate is not correctly renewed, or if you need to add names or remove them from it, you need a new certificate and hence revalidating ALL names in the certificate at the same time, which can be cumbersome.