Must a separate virtual host be made for mail subdomains?

[rg305]

You already have two valid certs that cover the mail name:

@sangstar

Certificate Name: mail.sangstar-mail.tk
Domains: mail.sangstar-mail.tk

Certificate Name: sangstar-mail.tk
Domains: sangstar-mail.tk mail.sangstar-mail.tk www.sangstar-mail.tk

Looks like you could just do with the second one and delete the first one.
If so, then:
sudo letsencrypt delete --certname mail.sangstar-mail.tk

And keep just:

@sangstar

Certificate Name: sangstar-mail.tk
Domains: sangstar-mail.tk mail.sangstar-mail.tk www.sangstar-mail.tk

Then you might want to confirm that it can be renewed:
sudo letsencrypt renew --dry-run