certificate name mismatch

TLS validation compares the name you asked for against the names the certificate claims in its subjectAltName field — current clients ignore the common name entirely. Resolving to the right server is not enough, and never was. An ISPConfig install obtains one certificate, for the server's own hostname, and symlinks it to /etc/postfix/smtpd.cert: Postfix and Dovecot present that name to everybody. Point a mail client at mail.customer-domain.example, whose A record is flawless, and it connects and then fails validation on a name the certificate never claimed. The error reads like a broken mail server; the fix is the hostname typed into the client. openssl s_client -connect mail.example.com:993 -servername mail.example.com -verify_hostname mail.example.com prints Verify return code: 62 (Hostname mismatch) and the names actually on offer. A wildcard certificate covers one label: *.example.com covers mail.example.com, not example.com.