I've recently purchased an SSL certificate, and it says that it's limited to three servers. Surely if I have the key and certificate on multiple servers (more than 3), the SSL will still be valid? Can someone clarify why/how vendors can limit this? An example of one is 123-reg's 123-SSL (which is a resell of AlphaSSL).
There are no technical reasons for such a limit, it's purely licensing (i.e. revenue, and maintaining market segmentation). There are some considerations relating to the secure transfer of the key between systems when you do this, but this is easily addressed.
If you violate the license or terms of an agreement you risk (at least) getting your certificate revoked.
They (the CA/reseller) might be able to tell how many servers you have by:
Neither method is reliable and conclusive however.
It is possible to put public IP addresses in certificates, though some CAs do not support this (e.g. GoDaddy). This is not commonly used in for standard "web" certificates. Such a "name" is only checked by browsers if the URL contains an IP address in the host part (i.e. the browser doesn't check both IP and DNS for URLs containing DNS names). Web servers don't tend to check the certificates they are presenting as thoroughly as a browser, and assume the administrator knows what they are doing. Even if this worked as a method of limiting concurrent use by causing (user-visible) browser errors, it would only be effective if all servers had public IP addresses (no NAT or front-end proxy/load-balancer).