Ahh keystore looks like the next stopper. You need to run zmcreatecert and then zmcertinstall twice. Once for mta and once for mail box. So like:
zmcertinstall mta /opt/zimbra/ssl/ssl/server/smtpd.crt /opt/zimbra/ssl/ssl/ca/ca.key
zmcertinstall mailbox /opt/zimbra/ssl/ssl/server/smtpd.crt /opt/zimbra/ssl/ssl/ca/ca.key |