From master.cf

10.0.0.1:smtps inet n       -       n       -       -       smtpd
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject_unauth_destination
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_tls_security_level=encrypt
  -o smtpd_tls_wrappermode=yes
  -o smtpd_tls_cert_file=/usr/local/etc/postfix-config/CERTS/supernews.example.org.cert
  -o smtpd_tls_key_file=/usr/local/etc/postfix-config/CERTS/supernews.example.org.nopassword.key


from dovecot.conf

ssl_cert_file = /etc/ssl/certs/imaps.example.org.cert
ssl_key_file = /etc/ssl/private/imaps.example.org.key




    client {
      # The client socket is generally safe to export to everyone. Typical use
      # is to export it to your SMTP server so it can do SMTP AUTH lookups
      # using it.
      path = /var/spool/postfix/private/auth
      mode = 0660
      user = postfix
      group = postfix
    }