Comment # 8 on bug 967528 from Christian Boltz

Please don't recycle old bugs for new problems ;-)

Anyway - your SSL certificate is in an unexpected location, and you'll need to
allow read access to it (or move it to the usual location in
/etc/ssl/private/).

The easiest way to update the profile is to run aa-logprof and allow dovecot to
read /etc/apache2/ssl.crt/mail.privustech.com_start.crt.

If aa-logprof asks about more permissions, please open a new bugreport and
attach your /var/log/audit/audit.log to it.