I would also check where the "... is not portable!" messaage is generated. If it's done by the configure script, you can look at the test to give you a hint as to why this message was generated.
For my setup, I did much the same as you but didn't have to set the SSL_CFLAGS, SSL_LIBS environment variables, nor did I set the --with-ssldir configure option (although your setup may need it).
Maybe check output of
file /Applications/openssl-1.0.2l.32/lib/libssl.so.1.0.0just to make sure your library's arhitecture matches your expectation.
# ./configure
--prefix=/Applications/dovecot-2.2.31.32
--with-ssl=openssl
--with-ssldir=/Applications/dovecot-2.2.31.32/certs
--with-storages=mbox,maildir,imapc,pop3c
I believe "--with-storages" option is now obsolete: all the storage backends are built, whether you ask for it or not.
Joseph Tam jtam.home@gmail.com