I have web hosting with with a provider and use their DNS service. But I don’t use their IMAP server – I host my own at home. Email clients like Thunderbird are averse to self-signed certs. So I generate a LetsEncrypt signed cert for my Dovecot IMAP server.

On my home machine:

• install the certbot utility (FreeBSD port : py37-certbot)
• run certbot:

certbot certonly --manual --preferred-challenges=dns --agree-tos --email=<my email address> -d <imap host name>

• confirm that I’m OK with my IP being logged

On the provider’s control panel web site:

• Add a DNS TXT record with the name and value generated by certbot
• Wait a few minutes for the DNS record to be served

Back on my home machine:

• Press Enter at the certbot prompt
• Wait for certbot to clean up and show the names of the files containing the cert
• Edit the Dovecot config file to point the ssl_cert and ssl_key lines to the files generated by certbot. Note that the first less-than sign on each line is part of the config. E.g.

ssl_cert = < <generated fullchain.pem file name>
ssl_key = < <generated privkey.pem file name>

• Restart Dovecot

When I need to renew the cert in a couple of months time, I can just do:

certbot renew