I use something like this script to renew my SMTP and IMAP certificates (/etc/cron.weekly/certbot-renew):
#!/bin/sh
hostcert=/etc/letsencrypt/live/mail.example.com certlink="$(readlink "${hostcert}/cert.pem")"
test -x /usr/bin/certbot || exit 72
certbot certonly --quiet --standalone --keep-until-expiring \ -d mail.example.com \ -d imap.example.com \ --email postmaster@example.com \ --agree-tos --expand
# Exit if the cert hasn't been updated test "${certlink}" = "$(readlink "${hostcert}/cert.pem")" && exit
cat ${hostcert}/fullchain.pem ${hostcert}/privkey.pem > /usr/lib/courier/share/esmtpd.pem cat ${hostcert}/fullchain.pem ${hostcert}/privkey.pem > /usr/lib/courier/share/imapd.pem systemctl restart courier