Today I learned that two of my customers have received LetsEncrypt renewal notices for domains belonging to different customers on the same server. The emails are coming from LetsEncrypt via Mandrill, as described here.

Apparently SolidCP is configuring a customer's email address in the ACME account details for each web server, and I think that email address is then used for every LetsEncrypt certificate on that server. I think the configuration ought to be the server admin's email address, but SolidCP used a customer's address instead.

I found a workaround method to verify and correct the setting on each web server:

1. Run C:SolidCPServerbinLetsEncryptwacs.exe
2. Enter "O" for "More options..."
3. Enter "A" for "ACME account details"
4. The configured email address will be displayed. If it's not what you want, enter "Y" to modify contacts.