About the certificates, you would have to make new ones for every webmail.domain.com. This is why I suggest using the alternative to this by setting it as domain.com/webmail. This way it will be covered by the domain's certificate
(Which is how I have mine setup now.)
