Finally got the IMAP server running over SSL. You need to produce a certificate and get it signed by a certificate server - which can be your own server. This does not provide a certificate signed by a known authority (such as Verisign) but if it only for internal use then that does not matter. The procedure is described here.