Let's Encrypt auto-renewal hook

Certbot renews certs in place but doesn't restart Dovecot. Without a reload, you keep serving the old cert until Dovecot restarts.

Add a deploy hook in /etc/letsencrypt/renewal-hooks/deploy/reload-dovecot.sh:

#!/bin/bash
systemctl reload dovecot
systemctl reload postfix

chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-dovecot.sh

Test certificate from outside:

openssl s_client -connect mail.example.com:993 -servername mail.example.com -showcerts < /dev/null | grep "Verify return code"

Want Verify return code: 0 (ok).

SNI for multiple hostnames: add per-name blocks:

local_name imap.alt.example {
  ssl_cert = </etc/letsencrypt/live/imap.alt.example/fullchain.pem
  ssl_key  = </etc/letsencrypt/live/imap.alt.example/privkey.pem
}