From master.cf
10.0.0.1:smtps inet n - n - - smtpd
-o smtpd_sasl_auth_enable=yes
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject_unauth_destination
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
-o smtpd_tls_security_level=encrypt
-o smtpd_tls_wrappermode=yes
-o smtpd_tls_cert_file=/usr/local/etc/postfix-config/CERTS/supernews.example.org.cert
-o smtpd_tls_key_file=/usr/local/etc/postfix-config/CERTS/supernews.example.org.nopassword.key
from dovecot.conf
ssl_cert_file = /etc/ssl/certs/imaps.example.org.cert
ssl_key_file = /etc/ssl/private/imaps.example.org.key
client {
# The client socket is generally safe to export to everyone. Typical use
# is to export it to your SMTP server so it can do SMTP AUTH lookups
# using it.
path = /var/spool/postfix/private/auth
mode = 0660
user = postfix
group = postfix
}