Problem with dovecot auth (SSL_accept() failed: error:14094416)

when I try auth to my dovecot server via outlook or other mail client, I get error. In dovecot logs I see:

dovecot[7776]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=52.125.139.50, lip=77.222.60.13, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<ZpVbIMKk7sM0fYsy>

my davacot -n:

# 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.21 (92477967)
# OS: Linux 4.15.0-20-generic x86_64 Ubuntu 18.04 LTS
auth_mechanisms = plain login
mail_location = mbox:~/mail:INBOX=/var/mail/%u
mail_privileged_group = mail
namespace inbox {
  inbox = yes
  location =
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix =
}
passdb {
  driver = pam
}
protocols = " imap pop3"
ssl_cert = </etc/letsencrypt/live/dutyfreesochi.ru/cert.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_key =  # hidden, use -P to show it
userdb {
  driver = passwd
}

my postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
compatibility_level = 2
inet_interfaces = all
inet_protocols = all
mailbox_size_limit = 0
mydestination = mail.dutyfreesochi.ru, dutyfreesochi.ru, mail.dutyfreesochi.ru, localhost.dutyfreesochi.ru, www.dutyfreesochi.ru, mail.dutyfreesochi.ru
myhostname = sonedmail2-vps-1
mynetworks = 127.0.0.0/8, 77.222.60.13
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relayhost =
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes

I try all what I can get in Google. Maybe someone was dealing with this problem.