Although it is possible now with Plesk to assign a certificate to the "webmail." sub-domain, the Let's encrypt extension does not add the alias to the certificate request.
This will result in the "webmail.domain.my" sub-domain to be served with a certificate of only "domain.my" and...