Just a note for myself here as I won’t remember it otherwise. Copy domain.crt and gd_bundle.crt to etc/ssl/certs. But for postfix concat domain.crt and gd_bundle.crt to server.pem, that seems to fix postfix. Apache and courier don’t seem to require anything extra to work. Verify with TLS Receiver.
I’m sure the above makes a great deal of sense to you. Had a fairly mundane day apart from that. About to have a shower and eat salad.
And several years later this still comes in handy!
Oh and one more thing….
For courier:
cat domain.key domain.crt > courier.pem
cp courier.pem /etc/courier/courier.pem
Also not sure the server.pem is actually required, test again in a couple of years!