Just for the records:
The reason was an updated external root certificate, that I had
imported with bad trust attributes about 2 years ago. My bad.
After fixing the trust attributes freeipa is running again,
probably better than before. There is just a minor issue with
a duplicate csreplica agreement. New thread.
A big thanx to Flo and Rob. They showed helpfulness and competence
in their answers, next to a huge amount of patience.
I highly appreciate your help
Harri