Dovecot cannot read TLS certificate
The keys cannot be read because SELinux has denied access to them.
To fix the problem, copy (using cp or mv -Z) the keys to a directory where SELinux expects TLS keys and certificates to be stored, i.e. /etc/pki/tls and its subdirectories. The new files will have the correct SELinux contexts if you used cp or mv -Z. Then update the files' locations in your Dovecot configuration.