When using Dovecot as an IMAP proxy (e.g. for handling client certificate authentication) it is important to disable to IMAP pipelinging with :
proxy_nopipelining=y
The nginx in the Zimbra MTA seems not be able to handle 'Capability' checks and the 'Login' command when sticked together at proxy login step (pipelineing).
Tested and debugged with Zimbra 8.0.7 Network Edition