If your certificate doesn't match the current private key, or is
miss formatted etc, then you may loose connection to this page
when you press 'save changes', instead use the non ssl admin port:
http://your.server:7026, examine mail.err for the cause,
remove ssl/surge_cert.pem and restart surgemail to recreate a
working unsigned certificate!
You can install your certificate manually by replacing the file
ssl/surge_cert.pem and place the intermediate certifictes in surge_chain.pem then restart surgemail.
If your certificate was created from a different private key then
also replace ssl/surge_priv.pem. If your certificate is
faulty in any way ssl will not work, in that case examine mail.err
to find the cause, and remove surge_cert.pem and restart surgemail
to recreate an unsigned but working certificate.
If you are using g_ssl_perdomain "true" then place certifictes in ssl/mail.domain.name folders
Generally for an ssl certificate you should make sure you have url_host defined for each domain, e.g. for xyz.com url_host should be "mail.xyz.com"
If you are using a wild card ssl certificate and want it to match correctly with any sub domain used, then use the new setting ssl_wildcard "*.xyz.com" so it will match correctly.
Lets encrypt is a free service to create SSL certificates automatically and update them each month, to use it see the instructions here.