It’s per certificate. The certificate can be used on any network interface on the device (wired, wireless, VPN).
If the wired connection is present during Onboarding, both the wireless and wired MAC addresses will be embedded in the certificate (if the MAC address is available)