I agree

Hey Sabatino, 

When this feature was in beta it was originally at the domain level. But then we realized that this should be done at the system level because domain admins are most often the end users and they would not always understand what a certificate is and how it should be set up etc. So we concluded that the SSL configuration should be the responsibility of the system admin and moved it to the system level. The fallback cert is there in case the domain doesn't have a certificate because while they would get a certificate error SSL/TLS would still work. In most cases and configurations SSL and hostnames will be universal on domains that are hosted on the same server. This is how most people's SmarterMail servers are configured that I've looked at. 

But please let me know what you think and what your argument is for this and I will put it in the feature request. 

Kind Regards, 

But I certainly didn't mean to let domain administrators manage SSL.

Still at system administration, but at the individual domain level.

Already now, not everything that is set at the domain level can be managed by the domain administrator (for example: quotas, features, security)

So you could manage SSL at the domain level without giving the domain administrator access to it