In acme.sh configurations, the field Le_RealFullChainPath isn't set:
/var/db/acme/certs/mail.nasqueron.org_ecc/mail.nasqueron.org.conf
Le_RealCertPath='/var/certificates/mail.nasqueron.org/cert.pem' Le_RealCACertPath='/var/certificates/mail.nasqueron.org/chain.pem' Le_RealKeyPath='/var/certificates/mail.nasqueron.org/key.pem' Le_ReloadCmd='' Le_RealFullChainPath=''
That broke the TLS configuration for e-mail services:
$ cd /var/certificates/mail.nasqueron.org $ ls -lah total 19 KB drwxr-x--- 2 acme mail 6B May 20 2025 . drwx--x--x 6 acme wheel 6B Nov 5 2024 .. -rw-r--r-- 1 acme mail 1.3K Jan 6 03:06 cert.pem -rw-r--r-- 1 acme mail 1.5K Jan 6 03:06 chain.pem -rw-r--r-- 1 acme mail 2.8K Dec 9 07:59 fullchain.pem -rw-r----- 1 acme mail 227B Jan 6 03:06 key.pem
We see the fullchain.pem wasn't regenerated.
When regenerated with cat cert.pem chain.pem > fullchain.pem, the services (nginx, postfix) served the right certificate.