the saslauthd.conf looks reasonable to me, is it right?
[zimbra@mail ~]$ cat /opt/zimbra/cyrus-sasl/etc/saslauthd.conf
zimbra_url:
https://mail.agroup.com/service/soap/
zimbra_cert_file: /opt/zimbra/conf/smtpd.crt
zimbra_cert_check: off
[zimbra@mail ~]$
After some tinkering and more forum searching, I changed the url in (saslauthd.conf.in)to use http not https, restarted zmsaslauthdctl and authentication is working now. So my conclusion is that during the upgrade, the zimbra_url was changed from http to https. Hope this helps you guys fix the bug.