I found out, that due to an unknown reason the webserver configuration files weren't rebuild, although a task to do so was scheduled. I manually removed all tasks from the database table panel_tasks, manually added a task with the »with type = 99 - then reran cronjob with --force« and --debug. Than all config files were created and the new certs started working.
I can't evaluate what exactly went wrong, but I think, (1) the crontab file was corrupt (could not edit it with contabe -e -u root) (2) a faulty task somehow blocked the cron script to do its work when called manually.
So, if someone has similar issues, maybe it is worth the effort to clear the task table.