I could get it work with the following :
then I would go to https://whatsmychaincert.com to check my certificate,
and all test get me to the right point, and my email client works fine
let'sencrypt store date in
just put this information on postfix configuration:
it will be always generated automatically 1 month before expire date, thus postfix will always look for the right certificate.