I've solved the issue by setting ssl to 'any-cert' and starttls to NULL. This does a proper SSL request to the node.

I still don't understand why Dovecot does a non-SSL request on an SSL port whenever I enable starttls, but I'm happy using normal SSL.

Regards,