
Securing Plesk is ok, but mailserver uses certificate from domain.
plesk: mail.domain.com:8443 => Certificate for mail.domain.com
mail: mail.domain.com => Certificate for domain.com/www.domain.com/webmail.domain.com
Additionally:
I could only update from U1 to U2 with setting the used Certificate for domain.com to mail.domain.com. Before that there was always an timeout on https://mail.domain.com:8447, with something being wrong with TLS Handshake.