to avoid :

root@mail:/etc/ssl/certs# tailf /var/log/dovecot.log 
dovecot: May 29 15:05:15 Error: pop3-login: Can't load private key file 
/etc/ssl/certs/ssl-cert-snakeoil.pem: error:0906D06C:PEM 
routines:PEM_read_bio:no start line
dovecot: May 29 15:05:15 Error: child 15890 (login) returned error 89
dovecot: May 29 15:05:15 Error: child 15891 (login) returned error 89
dovecot: May 29 15:05:15 Error: child 15892 (login) returned error 89
dovecot: May 29 15:05:15 Error: child 15893 (login) returned error 89
dovecot: May 29 15:05:15 Error: pop3-login: Can't load private key file 
/etc/ssl/certs/ssl-cert-snakeoil.pem: error:0906D06C:PEM 
routines:PEM_read_bio:no start line
dovecot: May 29 15:05:15 Error: imap-login: Can't load private key file 
/etc/ssl/certs/ssl-cert-snakeoil.pem: error:0906D06C:PEM 
routines:PEM_read_bio:no start line
dovecot: May 29 15:05:15 Error: imap-login: Can't load private key file 
/etc/ssl/certs/ssl-cert-snakeoil.pem: error:0906D06C:PEM 
routines:PEM_read_bio:no start line 

correct in /etc/dovecot/dovecot.conf : Replace

ssl_key_file = /etc/ssl/certs/ssl-cert-snakeoil.pem

By ssl_key_file = /etc/ssl/private/ssl-cert-snakeoil.key

 and allow user devocot read right for .  /etc/ssl/private/ssl-cert-snakeoil.key by adding him to ssl-cert  as secondary group  :