I have much the same, only with a path pointing to the fullchain.pem file from LE. I suspect it is not readable by the http server, so how are you getting that /etc/Ppi file generated, since it is not the same path as you show in dovecot?
I tried linking to the fullchain.pem, but I haven't tried making a local copy for Roundcube yet.
The paths to the certs work fine for https via Apache.