It took shutting down nginx on port 80 and a single command to generate mail certificates with letsencrypt
letsencrypt certonly --standalone -d <mail server dns name>
https://www.upcloud.com/support/secure-postfix-using-lets-encrypt/
Let's encrypt is awesome.