It looks like, judging by the line;

that it is saying that you are using a CA certificate (usually bundled with your SSL certificates that you purchase), instead of the acutal certificate for your server. This would cause a failure, because your server can't use a CA certificate for this purpose...

I hope that this helps!

I'm aware of the certificate issue. the problem is that the "no login" means RoundCube doesn't present a login interface - presumably because of the apache core.

When attempting to login to the Roundcube  interface you get a "no response from server" message in the browser.
Oddly enough it is still up from the last reboot yesterday or I would post the browser message.

Edit -- when this happens, there are still apache processes alive on the server.

That IS the apache error log file in the original post...

The Roundcube interface isn't responding again with apache instances still in the process table, and the iRedAdmin interface doesn't respond, leading me to think it's an issue with Apache, but I really have no clue.

Now even a reboot won't bring it up and remote IMAP clients are being refused access.

$ ps -ef | grep apache
root       928     1  0 Jul28 ?        00:00:05 /usr/sbin/apache2 -k start
iredadm+ 20422   928  0 07:35 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 20423   928  0 07:35 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 20424   928  0 07:35 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 20426   928  0 07:35 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 20429   928  0 07:35 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 20431   928  0 07:35 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 20610   928  0 07:41 ?        00:00:00 /usr/sbin/apache2 -k start

Firefox error is this --

Firefox can’t establish a connection to the server at mail.xx.xxx.

    The site could be temporarily unavailable or too busy. Try again in a few moments.
    If you are unable to load any pages, check your computer’s network connection.
    If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the Web.

Current apache access and error log :

Error log:

[Sun Jul 30 07:35:44.693154 2017] [mpm_prefork:notice] [pid 928] AH00163: Apache/2.4.18 (Ubuntu) OpenSSL/1.0.2g mod_wsgi/4.3.0 Python/2.7.12 configured -- resuming normal operations
[Sun Jul 30 07:35:44.693176 2017] [core:notice] [pid 928] AH00094: Command line: '/usr/sbin/apache2'
[Sun Jul 30 12:53:12.694493 2017] [core:error] [pid 20423] [client 84.108.1.124:57409] AH00126: Invalid URI in request GET login.cgi HTTP/1.0

access log for the same time:

# cat access.log
45.55.21.148 - - [30/Jul/2017:07:41:49 +0000] "GET / HTTP/1.1" 200 354 "-" "Mozilla/5.0 zgrab/0.x"
91.230.47.3 - - [30/Jul/2017:07:47:06 +0000] "GET / HTTP/1.0" 200 331 "-" "-"
144.48.243.115 - - [30/Jul/2017:07:57:46 +0000] "GET / HTTP/1.1" 200 312 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
74.82.47.2 - - [30/Jul/2017:09:00:29 +0000] "GET / HTTP/1.1" 200 1919 "-" "-"
45.79.223.204 - - [30/Jul/2017:10:09:02 +0000] "GET / HTTP/1.0" 400 0 "-" "-"
91.230.47.3 - - [30/Jul/2017:10:32:40 +0000] "GET / HTTP/1.0" 200 331 "-" "-"
91.230.47.3 - - [30/Jul/2017:11:34:16 +0000] "GET / HTTP/1.0" 200 331 "-" "-"
141.212.122.128 - - [30/Jul/2017:12:14:28 +0000] "GET /x HTTP/1.1" 400 0 "-" "Telesphoreo"
84.108.1.124 - - [30/Jul/2017:12:53:12 +0000] "GET login.cgi HTTP/1.0" 400 457 "-" "-"
91.230.47.3 - - [30/Jul/2017:13:37:19 +0000] "GET / HTTP/1.0" 200 331 "-" "-"
66.96.206.68 - - [30/Jul/2017:14:03:36 +0000] "GET / HTTP/1.1" 200 331 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36"
91.230.47.3 - - [30/Jul/2017:14:37:21 +0000] "GET / HTTP/1.0" 200 331 "-" "-"
91.196.50.33 - - [30/Jul/2017:15:00:37 +0000] "GET http://testp3.pospr.waw.pl/testproxy.php HTTP/1.1" 404 425 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"
177.182.4.208 - - [30/Jul/2017:15:02:19 +0000] "GET /cgi/common.cgi HTTP/1.0" 404 439 "-" "Wget(linux)"
177.182.4.208 - - [30/Jul/2017:15:02:20 +0000] "GET /stssys.htm HTTP/1.0" 404 435 "-" "Wget(linux)"
177.182.4.208 - - [30/Jul/2017:15:02:20 +0000] "GET / HTTP/1.0" 200 331 "-" "Wget(linux)"
177.182.4.208 - - [30/Jul/2017:15:02:21 +0000] "POST /command.php HTTP/1.0" 404 436 "-" "Wget(linux)"

Looks like I'm getting vulnerability scans that are causing the login interface to cure?

No.

Edit -- wait - let me restate that -- not that I am aware of nor do I see any evidence of it in any logs.
But just because I don't see it doesn't mean it isn't true.

I am however able to ssh directly the mail server while it is not responding so I assume the IP has not been blocked...

It's down again.  Whatever is happening is taking the whole mail server down -- my clients inside my NAT's networwk can't connect, neither can my android phone on the carriers network. 

I do have one server on my internal network acting as a forwarder for all the internal hosts to send out monitoring script output to the iRedmail server.  I haven't yet been able to correlate the stop-functioning time with any undue load from forwards from that host yet.

OK, I see the domain where all of my clients reside is on the list as

REJECT     all    ---    mydomain.com     anywhere    reject-with icmp-port-unreachable 

All of my clients resolve to a different domain because of sitting behind a NAT'd firewall.
But it works sometimes, just not others...

I never really caught this because the fail2ban.log file is always 0 bytes.

Is the (right) fix to put the mail server in the same domain as all the clients?

Edit 2:
I removed the iptables line - what would be the most secure method to alleviate this?
Or determine perhaps why it's getting tripped now in the last couple of weeks when it had never been before.
I suspect some monitoring scripts that output mails that I want to send to that server are the issue - the mail terminates at that mail server, so is it just volume/frequency from the same source doing it?

In the long term -- the mail server sits in one domain and handles mail for that domain and another.What is the safest way to handle that sort of configuration?

I added the second domain in iredadmin. 
I'm still seeing "helo rejected: Host not founf; from=<root@seconddomain.com>" entries in the syslog, followed by "fail2ban.filter[1104]: INFO [postfix-iredmail] Found my ip address".

I have tried adding the ip address and then the ip address and domain name to the whitelist -- "python wblist_admin.py --add --whitelist " and still the emails are rejected.  Waiting to see if the domain still gets added to an iptables REJECT rule.

"whitelisting" doesn't do what the name implies?

First of all, message

Helo command rejected: Host not found; ... helo=<www.otherdomain.com>

means that DNS query cannot resolve hostname www.otherdomain.com, so this exact domain needs to have a working DNS A record pointing to an IP address.

Second, white and blacklists are based on sender email address and IP address, not HELO id. So whitelisting would not affect HELO errors.

Third, you should turn off fail2ban while setting up new domains, migrating or whatever testing that involves creating new domains or mailboxes. You can also adjust fail2ban limits to your needs.

You're most likely having issues with your network, DNS and/or with other configs that are not related to iredmail. You also need to fix SSL issues, they possibly lead to other problems. Iredmail works extremely well on a clean server with regular connections and valid DNS records.