My mail SSL is still self-signed

Same issue. Same error #47. Can’t seem to issue a proper security certificate on a subdomain. Redirect loop detected. I’ve tried all kinds of things. Updated CP. Turned off ModSecurity. Restarted everything. Nothing helps. I hate when I’m just “trying stuff” with only partial understanding of the underlying principals.

Could the redirect loop have something to do with the fact that mail.whatever.com is an alias (A record) for whatever.com and the mx record for whatever.com is mail.whatever.com? Does seem like that would just be going round and round?

This is actually part of a wider issue I’m having with expired end-user certs that aren’t being updated: