I have not implemented an e-commerce system, but here are my thoughts.
Though it would be hard to say for sure what's best without more details of exactly what you're setting up and what the risks are, generally speaking using separate Wordpress installations for separate sites makes sense, provided that you make sure things are configured properly so that:
- If one is penetrated or crashes, the others are unaffected and not vulnerable as a result.
- All of them are maintained (e.g., get security updates in a timely manner).
As for self-signed certificates, if the general public is accessing your e-commerce site and supplying sensitive information like credit card numbers (which I am assuming must be the case, based on your description), you should have a certificate signed by a certificate authority, not a self-signed cert.
The reason for this is that someone else could just make their own self-signed certificate that says they are you.
The signature will not be the same, but there is no way for anybody to know which one is the real you.
Self-signed certificates are mainly good for:
- Situations where there is a secure back-channel between you and anyone who needs to trust the connection. (For this, self-signed certificates are sometimes actually preferred, because even less trust is placed in the hands of third parties.)
- Situations where information about your certificate will be widely published (web of trust). Typically this still only appropriate for websites if your certificate will only be used for SSL connections established for moderately sensitive purposes (not e-commerce).
- Situations where it is impossible or useless for anybody to sign your certificate because no pertinent certificate authority exists, but your certificate will be extremely widely distributed, verified through other means, and probably even hard-coded into software or distributed under other secure means. I'm really just talking about certificate authorities' own certificates, here.
- Sites that cannot afford to pay fees to a certificate authority, and don't really need SSL, but provide it with the hope that it will be of some benefit. (If you're doing e-commerce, you need SSL.)
A bit of information on self-signed certificates can be found here (though I guess you may already have read that).