Postfix 3.4 and later now allows SNI maps to deal with multiple certificates for different domains/subdomains:
Hints about configuring it properly with Let's Encrypt:
In summary, here is what user @MK of the Postfix mailing list says (in case the above link goes down for some reason):
----- main.cf -----
# provide the primary certificate for the server, to be used for outgoing connections
# provide the map to be used when SNI support is enabled
tls_server_sni_maps = hash:/etc/postfix/vmail_ssl.map
----- /etc/postfix/vmail_ssl.map -----
# Compile with postmap -F hash:/etc/postfix/vmail_ssl.map when updating
# One host per line
$ postmap -F hash:/etc/postfix/vmail_ssl.map
postfix as normal.
$ openssl s_client -connect localhost:25 -servername servername.otherdom.com -starttls smtp
$ openssl s_client -connect localhost:25 -servername servername.serverdom.com -starttls smtp
To test: you'll find the hostname under the certificate details. It will match the default server name of the host if there is not a match. Be sure the server name of the host is in the map file for that reason.
Note: I haven't tested this out myself, I was just looking for some hints on how to do it, and by chance came across this SF thread...