I'm trying to add SSL into my surgemail but I'm completely clueless on how to do this.

Here is my setup

I have a windows network and Surgmail is installed on a ubuntu server
my hosting provider forwards the MX record to our static IP, the IP is forwarded using our PFSense firewall

I didn't know the basics, do i need to do anything with my web host provider which forwards the MX record?

I was trying to use "lets encrypt" I update my Ubuntu to v 16
but when setting it up it asks for domain i select mail.mydomain.com which I can ping and get a response I may sure I had an DNS A for mail.mydomain.com pointing the the IP address of the mail server , I made sure port 443 also points to the mail server, but I get an error

Failed authorization procedure. mail.mail.com (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to connect to host for DVSNI challenge

IMPORTANT NOTES:
- The following errors were reported by the server:

    Domain: mail.mydomain.com
    Type: connection
    Detail: Failed to connect to host for DVSNI challenge

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you're using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.


I don't' even know if I'm a step in the right direction so I'm not sure if I should waste more time on this, How are most people using surgemail with SSL are they using a paid service? if so which ones?