Email server configuration still complaining the connection isn't secure

Inspecting the certificate shows that the certificate has expired.

Since the webserver provides a valid certificate, it seems that the mail service hasn't been restarted after the certificate was renewed and is still serving the old certificate.

A restart of the mail service should fix the problem.

To prevent such problems in the future you can use the renew-hook of certbot with a simple shell script.

This is a script I am using:

#!/bin/bash
for domain in $RENEWED_DOMAINS
do
    if [ "$domain" = mail.example.com ]
    then
        systemctl reload dovecot
        systemctl reload postfix
    elif [ "$domain" = intern.example.com ]
    then
        cp /etc/letsencrypt/live/$domain/* /etc/ldap/ssl/
        chown -R openldap:openldap /etc/ldap/ssl/
        chmod 640 /etc/ldap/ssl/*
        systemctl reload slapd
    else
        systemctl reload apache2
    fi
done

The script is provided to certbot with the --renew-hook parameter in the cron job:

/opt/certbot-auto --renew-hook /opt/certbot-renew renew --quiet --no-self-upgrade