Out of curiosity does your cert name match your Zimbra host name? Ran into a similar problem myself. The guys in support (kudos to Brian, Mike and Ramadan) were able to get the issue resolved. During the initial upgrade, the tomcat cert migrated over, but nothing else was maintained. When re-installing the commercial cert with zmcertmgr it halted mail delivery. It was traced down to the tls communication between postfix and ldap and because the hostname of the zimbra server did not match the certificate name. The quick work around was to modify the zmmtainit to turn of tls, once that was done everything worked fine.
My understanding is that bug 23922 is tracking this issue and it appears there is at least a work around done. |