>> 1. I need a certificate for this, correct?
no. You only need a certificate if SSL is being used. If you are not using SSL you should consider the data viewed by a user, even if logged in, as "not private".
>> Or, is it possible to assign the url to their ip address and let it go at that?
correct.
>> 2, If it is hosted elsewhere, does the hosting company provide the cert?
no. In order to get the cert for a domain, you have to be the owner of that domain. If your client owns the domain (say abc.com) then they need to get the cert. (Well, you can do it for them, but you'd need all the necessary paperwork, and you'd probably want to work with a technical person at their place who will need to answer questions intelligently when the phone rings.)
>> 3. Is the certificate for the web the same as the certificate that is used for an application (installation)?
nope.
cheers
Bruce