The solution has been posted at https://github.com/certbot/certbot/issues/5424#issuecomment-372126909: restarting dovecot holds stderr open, this blocks python. Changing the script in the following way solved my problem:
#!/bin/sh
service dovecot restart 2>/dev/null
solved Certbot renewal hook won’t finish [closed]