To to enable Let's Encrypt by default for all new mail domains if you're using Virtualmin

By default Virtualmin does not configure the mail.yourdomain.com virtual alias so you can’t easily just get the Let’s Encrypt certificate to work with it.

The solution is to add a serverAlias default for all new domains. We recommend you add both mail.yourdomain.com and webmail.yourdomain.com

To do this, navigate to:

Virtualmin / System Settings / Server Templates / select default / in drop down menu select Apache website.

Add

ServerAlias mail.${DOM}
ServerAlias webmail.${DOM}

Reference:

https://www.virtualmin.com/node/39343