1) Is your question actually about the Web SSL Installer app? Or is it just about heavy forwarders in general? If it's only about heavy forwarders, you should remove that tag so that people are not confused in the future. If it is about the Web SSL Installer app, could you add more detail because as it stands it sounds like this is a generic question.
2) Splunk does support installing onto an image and then subsequently cloning it, look into clone-prep-clear-config and some documentation https://docs.splunk.com/Documentation/Splunk/6.6.0/Admin/PutSplunkontosystemimages If you're just copying the install directory clone-prep may also be of use.
3) Having a Heavy Forwarder contact the license server is very much so an "it depends" sort of thing in regards to heavy forwarders. In the strictest sense, no, a Heavy Forwarder can collect and forward data using the built in Forwarder license. That said, in the past I've seen versions of TAs / Apps that I'd want to run on a heavy forwarder that would break if they didn't have access to enterprise functionality (due to how some shipped scripts were written). As a result we'd attach them to the license server, they wouldn't do any indexing, and wouldn't count against our license quota (as they're forwarding all data), but attaching them gives them access to all the needed features. Another question is how do you plan on managing and authenticating to said heavy forwarder, If you're managing users who'd log into the heavy forwarder to manage things with LDAP, that requires an enterprise license and thus the instance should talk to the license server.
