How can I expand a cert to mail. subdomain if it does not respond through HTTP?

Usually you only have to configure the mailserver once and let Certbot run a reload command automatically after deployment (using the --deploy-hook).

Oh, Windows, well, yeah, then all bets are off I guess.

2 Likes