One of the things that tripped me up at first was the postfix settings. smtpd_* options are for receiving mail, and smtp_* (no d) are for sending. So you need

One of the things that tripped me up at first was the postfix settings. smtpd_* options are for receiving mail, and smtp_* (no d) are for sending. So you need smtp_tls_cert_file = /etc/letsencrypt/live/$domain/fullchain.pem smtp_tls_key_file = /etc/letsencrypt/live/$domain/privkey.pem smtp_tls_security_level = may # or encrypt, to force TLS Also, yes, if I understand you correctly your cert should include subdomain.example.com even if the web-facing content there doesn't use HTTPS.