Comment # 1 on bug 1099764 from Christian Boltz

The dovecot profiles that need access to the certificates have
    #include <abstractions/ssl_keys>
and that abstraction allows to read everyting in /etc/ssl/ ("/etc/ssl/** r,")
so everything should work as expected.

Do you have a "real" problem (breakage in dovecot or DENIED lines in
/var/log/audit/audit.log), or did you only stumble over this after reading the
dovecot profiles?