diff --git a/app/Livewire/Ui/Security/SslCertificatesTable.php b/app/Livewire/Ui/Security/SslCertificatesTable.php
index d8a984a..d0a1972 100644
--- a/app/Livewire/Ui/Security/SslCertificatesTable.php
+++ b/app/Livewire/Ui/Security/SslCertificatesTable.php
@@ -51,7 +51,7 @@ class SslCertificatesTable extends Component
         if (str_contains($out, 'No certificates found')) return [];
 
         $certs  = [];
-        $blocks = preg_split('/\n(?=Certificate Name:)/m', $out);
+        $blocks = preg_split('/\n(?=\s*Certificate Name:)/m', $out);
 
         foreach ($blocks as $block) {
             if (!preg_match('/Certificate Name:\s*(.+)/i', $block, $nameM)) continue;
diff --git a/resources/views/livewire/ui/system/settings-form.blade.php b/resources/views/livewire/ui/system/settings-form.blade.php
index 19f9b0a..45380a0 100644
--- a/resources/views/livewire/ui/system/settings-form.blade.php
+++ b/resources/views/livewire/ui/system/settings-form.blade.php
@@ -363,7 +363,7 @@
                                         {{ $label }}
                                         @if($st === 'nodns') <span style="font-size:10px"> — kein DNS-Eintrag</span>
                                         @elseif($st === 'error') <span style="font-size:10px"> — fehlgeschlagen</span>
-                                        @elseif($st === 'skip') <span style="font-size:10px;color:var(--mw-t4)"> — kein Zertifikat nötig</span>
+                                        @elseif($st === 'skip') <span style="font-size:10px;color:var(--mw-t4)"> — übersprungen</span>
                                         @elseif($st === 'running') <span style="font-size:10px;color:var(--mw-t4)"> — läuft…</span>
                                         @endif
                                     </span>
diff --git a/scripts/mailwolt-apply-domains b/scripts/mailwolt-apply-domains
index 8855e8c..a6da862 100755
--- a/scripts/mailwolt-apply-domains
+++ b/scripts/mailwolt-apply-domains
@@ -26,7 +26,7 @@ cat > "${NGINX_SITE}" <<CONF
 server {
   listen 80;
   listen [::]:80;
-  server_name ${UI_HOST} ${WEBMAIL_HOST};
+  server_name ${UI_HOST} ${WEBMAIL_HOST} ${MAIL_HOST};
 
   root ${APP_DIR}/public;
   index index.php index.html;
@@ -87,7 +87,7 @@ certbot_safe() {
 }
 
 if [ "${SSL_AUTO}" = "1" ]; then
-  for DOMAIN in "${UI_HOST}" "${WEBMAIL_HOST}"; do
+  for DOMAIN in "${UI_HOST}" "${WEBMAIL_HOST}" "${MAIL_HOST}"; do
     [ -z "${DOMAIN}" ] && continue
     if cert_needs_action "${DOMAIN}"; then
       certbot_safe "${DOMAIN}" || true
@@ -99,17 +99,19 @@ fi
 # Nur HTTPS wenn LE-Cert tatsächlich vorhanden, sonst HTTP-only (kein self-signed Fallback)
 UI_HAS_CERT=0
 WM_HAS_CERT=0
+MAIL_HAS_CERT=0
 [ -f "/etc/letsencrypt/live/${UI_HOST}/fullchain.pem" ]      && UI_HAS_CERT=1
 [ -f "/etc/letsencrypt/live/${WEBMAIL_HOST}/fullchain.pem" ] && WM_HAS_CERT=1
+[ -f "/etc/letsencrypt/live/${MAIL_HOST}/fullchain.pem" ]    && MAIL_HAS_CERT=1
 (
 
 if [ "${UI_HAS_CERT}" = "1" ] || [ "${WM_HAS_CERT}" = "1" ]; then
-  # Mindestens ein Cert vorhanden → HTTP-Redirect Block
+  # Mindestens ein Web-Cert vorhanden → HTTP-Redirect Block (inkl. MAIL_HOST für ACME-Renewal)
   cat <<CONF
 server {
   listen 80;
   listen [::]:80;
-  server_name ${UI_HOST} ${WEBMAIL_HOST};
+  server_name ${UI_HOST} ${WEBMAIL_HOST} ${MAIL_HOST};
 
   location /.well-known/acme-challenge/ {
     root ${ACME_ROOT};
@@ -220,8 +222,14 @@ if [ -d "${STATE_DIR}" ]; then
       printf "error" > "${STATE_DIR}/webmail"
     fi
   fi
-  # Mail-Domain: kein certbot im Wizard für MX → skip (kein Fehler, nur nicht zutreffend)
-  [ -f "${STATE_DIR}/mail" ] && printf "skip" > "${STATE_DIR}/mail"
+  # Mail-Domain: LE-Cert für Postfix/Dovecot
+  if [ -f "${STATE_DIR}/mail" ]; then
+    if [ "${MAIL_HAS_CERT}" = "1" ]; then
+      printf "done" > "${STATE_DIR}/mail"
+    else
+      printf "error" > "${STATE_DIR}/mail"
+    fi
+  fi
 
   # done-Signal: immer schreiben damit der 2s-Poll stoppt
   if [ "${UI_HAS_CERT}" = "1" ] || [ "${WM_HAS_CERT}" = "1" ]; then
@@ -234,5 +242,31 @@ if [ -d "${STATE_DIR}" ]; then
   fi
 fi
 
+# --- Phase 4: Postfix + Dovecot mit Mail-Domain-Zertifikat konfigurieren ---
+if [ -n "${MAIL_HOST}" ] && [ "${MAIL_HAS_CERT}" = "1" ]; then
+  MAIL_CERT="/etc/letsencrypt/live/${MAIL_HOST}/fullchain.pem"
+  MAIL_KEY="/etc/letsencrypt/live/${MAIL_HOST}/privkey.pem"
+
+  # Postfix
+  if command -v postconf >/dev/null 2>&1; then
+    postconf -e "smtpd_tls_cert_file = ${MAIL_CERT}"
+    postconf -e "smtpd_tls_key_file  = ${MAIL_KEY}"
+    postconf -e "smtp_tls_cert_file  = ${MAIL_CERT}"
+    postconf -e "smtp_tls_key_file   = ${MAIL_KEY}"
+    systemctl reload postfix 2>/dev/null || true
+  fi
+
+  # Dovecot
+  if [ -d /etc/dovecot/conf.d ]; then
+    cat > /etc/dovecot/conf.d/10-ssl.conf <<DCONF
+ssl = yes
+ssl_cert = <${MAIL_CERT}
+ssl_key  = <${MAIL_KEY}
+ssl_min_protocol = TLSv1.2
+DCONF
+    systemctl reload dovecot 2>/dev/null || true
+  fi
+fi
+
 nginx -t && systemctl reload nginx
 echo "mailwolt-apply-domains fertig"