I continue to be amazed by the number of sites that have an SSL cert for domain.com and use the same cert for www.domain.com. Either spend the $10 on a second cert for www.domain.com or use a Subject Alt. Name.
Today's example: https://twitter.com versus https://www.twitter.com.