SSL gone "self-signed" on main WHM installation breaking email clients

The scenario a WHM host with many cPanel domains is called: host.whm-example.com Many of the actual clients are not using `mail.domain-name.com` as their email server, but rather the main hostname, `host.whm-example.com` I know, this is not how it's done but it's been like that for years and it's worked. Then boom! Suddenly today the main host installation decides it's going to install a self-signed certificate. Now every single email client is getting a certificate warning. I want to make sure the main host just renews itself like it's done for years but whatever certificate that always just worked. We have multiple A record for the hostname, I suspect this is a clue. I cannot deduce from the WHM user interface how to install a free certificate. I don't want to buy one for the main installation. We use Let's Encrypt, but I'm not sure if the main installation uses that. The screenshot gives a clue where I'm stuck.