SSL Certificates have undergone a few changes between the different versions of the BETA, and I can understand the confusion. Documentation is currently being worked on for this process, but I can give you some clarifications.
SNI is used to determine what certificate should be used for each connection. As a result, there is no longer any need for domains to set up their own certificates or Let's Encrypt integration. Instead, the system administrator uploads whatever certs they already have to the certificates folder (by default c:\smartermail\certificates).
Let's Encrypt will generate certificates to that folder as well, using the same format that IIS Centralized Certificate Store uses. As a result, it should be significantly easier to make your IIS use the same set of certificates.
If you have your own cert generation app (certbot, certifytheweb, etc), you can configure it to export to that folder as well and SmarterMail should immediately pickup the new certs as long as you use a consistent (or no) password on them.
If you enable Let's Encrypt in the options tab, it will automatically attempt to create certificates for all domains and domain aliases, also trying to prefix them with the Prefix Hostnames entries from the options tab. Any of the names that represent this same SmarterMail instance when accessed through HTTP will be added to the Let's Encrypt queue.
If you're not seeing that populate, it's likely that certifytheweb or another client manager is installed. Some of them intercept all validation requests to the entire server and will not allow SmarterMail to do the domain validation. If you use one of those, you need to either move to SmarterMail Generated certs completely and uninstall certifytheweb, or tell certifytheweb to export copies of the PFX files to the c:\smartermail\certificates folder
Now to port bindings. Because some clients do not support SNI, we need to have a fallback certificate for any secure connection. So you will still need to hook a certificate as a fallback certificate to each SSL/TLS binding the same way you have in the past. Until that's setup, the system cannot listen for TLS connections.
You can use a certificate under your c:\smartermail\certificates folder as your fallback certificate in port bindings if you wish, by the way.
We had toyed with just adding a "Make Default" option in the certificates list, but some customers have unusual setups where different IPs need different fallback certificates.