I am back after awhile, everything has been working great but i have a issue although the Cert is working for Postfix and Dovecot and website the issue I have,
Hostname of the Mail server is mail i have 3 domains which all works on webmail but i have run into a problem with the Mobile phone apps and some Desktop clients because of the hostname is mail but when connecting to the mail server via smtp and imap it uses smtp.domain.co.uk as well as imap.domain.co.uk now that goes against the Cert i have,
If you want email clients to use those hostnames in their settings and expect them to use TLS (SSL/STARTSSL), then yes, you should add those hostnames to the certificate.
Alternative, you can instruct your users to use a different hostname in their email clients, one that is already included in the certificate. Often the different hostnames point to the same IP address anyway.
Just use the same command, but just with the expanded list of hostnames. Note that Certbot requires all hostnames you'd like to have included in the cert to be used in the -d option, not just the hostnames you'd want to add.
You should probably be using a --deploy-hook instead of a --post-hook so that postfix and dovcot reload after every successful renewal rather than after every attempted renewal. It is also wise to enclose the domain name list in double quotes (-d "list").
You could, but it's generally inadvisable to use wildcard certificates if you don't specifically need to do so for several reasons. Additionally, it is usually advisable to only include a domain name and any subdomain names that share the domain name's webroot directory on a single certificate. This prevents cascaded failure should one of the domain names not renew successfully and avoids webserver configuration confusion where not all domain names reside within a single server block.
No. Domain 1 and 2 are different domains. i have 3 domains i am using on this SMTP Server, one is my personal email and the other is for my business and 3rd domain is my parents domain for there business
That path doesn't scale well.
I'd opt for a much shorter path: Use only one name for such services.
[Google does that with Gmail and millions are satisfied]
Thanks for your replies. I actually sorted the problem out by using Exchange/ActiveSync which works under mail.domain1 and so on, will migrate all clients over to Exchange on this Server. the Certs I have will do the job with Exchange.
On my mailserver, I just use a single hostname to avoid this specific problem. It's something like mail.example.com and serves https, imap, imaps, pop3, pop3s, smtp, and smtps using one cert for all.
All those services have different default ports and don't actually need a separate fqdn each.
Very true.
Unique FQDNs are only required when you need them to resolve to uniquely different IPs.
One IP can be just one FQDN [it can be more - but why complicate the simple?].