Please see this thread: Dovecot Failed state
I haven’t been able to reproduce this problem in my testing (and my servers that have the config discussed do not exhibit the problem), so I don’t know if that suggestion will help, but it’s all I’ve got. We’re definitely generating wrong config, but it seems to be harmless wrong config on my servers, but maybe in some cases it is not harmless. So, try it, and see what happens. Since it is cert related, this seems the most likely candidate.