Postfix 3.4 and later now allows SNI maps to deal with multiple certificates for different domains/subdomains:
http://www.postfix.org/postconf.5.html#tls_server_sni_maps
Hints about configuring it properly with Let's Encrypt:
http://postfix.1071664.n5.nabble.com/How-to-use-the-new-server-TLS-SNI-feature-3-4-x-td100786.html#a100819
In summary, here is what user @MK of the Postfix mailing list says (in case the above link goes down for some reason):
----- main.cf -----
# provide the primary certificate for the server, to be used for outgoing connections
smtpd_tls_chain_files =
/etc/letsencrypt/live/servername.serverdom.com/privkey.pem,
/etc/letsencrypt/live/servername.serverdom.com/fullchain.pem
# provide the map to be used when SNI support is enabled
tls_server_sni_maps = hash:/etc/postfix/vmail_ssl.map
-----
----- /etc/postfix/vmail_ssl.map -----
# Compile with postmap -F hash:/etc/postfix/vmail_ssl.map when updating
# One host per line
servername.serverdom.com
/etc/letsencrypt/live/servername.serverdom.com/privkey.pem
/etc/letsencrypt/live/servername.serverdom.com/fullchain.pem
servername.otherdom.com
/etc/letsencrypt/live/servername.otherdom.com/privkey.pem
/etc/letsencrypt/live/servername.otherdom.com/fullchain.pem
-----
Then run
$ postmap -F hash:/etc/postfix/vmail_ssl.map
Restart postfix
as normal.
Run
$ openssl s_client -connect localhost:25 -servername servername.otherdom.com -starttls smtp
$ openssl s_client -connect localhost:25 -servername servername.serverdom.com -starttls smtp
To test: you'll find the hostname under the certificate details. It will match the default server name of the host if there is not a match. Be sure the server name of the host is in the map file for that reason.
Note: I haven't tested this out myself, I was just looking for some hints on how to do it, and by chance came across this SF thread...