Do I have to have an ssl certificate for my mail server?

Do you want to prevent people from sniffing your password? This is especially easy on WiFi. Then use encryption (SSL).

Do you care about having a self-signed certificate (getting a warning about it)? If not, just self sign. But beware there are apps (outlook) that do not allow you to ignore that warning after having seen it once.

The thing with SSL is, that it incorporates encryption and identity checks in the same protocol. You don't need a certificate for the former, but you do for the latter. If you don't suspect someone is going to redirect your login attempts to another server, you don't need the identity check: so self-sign. And even then it is not really a problem. Because in most clients once you've accepted your own certificate, it will warn again when it changes.

If you do want a certificate (I like to have them), use Startcom SSL. They allow you to have a simple SSL certificate for free.

Edit: Startcom can now no longer be recommended, because they have been blacklisted by major browsers, because their new owner, WoSign, violated the rules.