I would also check where the "... is not portable!" messaage is generated. If it's done by the configure script, you can look at the test to give you a hint as to why this message was generated.
For my setup, I did much the same as you but didn't have to set the SSL_CFLAGS, SSL_LIBS environment variables, nor did I set the --with-ssldir configure option (although your setup may need it). Maybe check output of file /Applications/openssl-1.0.2l.32/lib/libssl.so.1.0.0 just to make sure your library's arhitecture matches your expectation.
# ./configure \ --prefix=/Applications/dovecot-2.2.31.32 \ --with-ssl=openssl \ --with-ssldir=/Applications/dovecot-2.2.31.32/certs \ --with-storages=mbox,maildir,imapc,pop3c
I believe "--with-storages" option is now obsolete: all the storage backends are built, whether you ask for it or not. Joseph Tam <jtam.h...@gmail.com>