The certificate served by mail.bechtold.ai on SMTP and IMAPS expired on 2026-07-09. Kubernetes Secret email-assistant/mailserver-tls contained the original certificate from 2026-04-10 and had no renewal controller. Kryptovisor Traefik had renewed the same hostname independently on 2026-06-10.
email-assistant/mailserver-tls.deployment/mailserver; rollout completed successfully.email-assistant-mail-tls-sync.service and .timer on drg-k8s.Ports 25, 465, 587, and 993 served certificate serial 060D25727EC8C4902989FC00FC23C0E418F2, valid from 2026-06-10 through 2026-09-08. The mailserver Deployment was 1/1 ready. A second run through systemd exited successfully without restarting the workload because the certificate fingerprint was already current.
Disable the timer with sudo systemctl disable --now email-assistant-mail-tls-sync.timer. Restore a known-valid mailserver-tls Secret and restart deployment/mailserver. Never restore the expired 2026-04-10 certificate.
The EmailAssistant autodeploy workflow was changed to apply only mailserver-config from MAILSERVER_SECRETS_YAML_B64 and explicitly skip mailserver-tls. A deployment can therefore no longer overwrite the automatically synchronized certificate with stale bootstrap material.