@Moritz_Bunkus, I hope you haven’t given up on me! 
I have found the curl error mentioned here and checked that ucs/server/sso/fqdn is correct and the certificate referred to by /etc/apache2/sites-enabled/univention-saml exists.
Since the web interface is working now, I tried “Create a new root certificate”. It was successful, but I ended up with the same error at the same step in the SAML SSO instructions. I am seeing different results in my browser now:
When I go to https://ucs-sso.[my domain], I get redirected to https://[hostname].[my domain]/univention/portal/ and the certificate common name is [hostname].[my domain] and no alternate names are shown.
When I go to https://ucs-sso (with no domain), there is no redirect, and the certificate common name is still [hostname].[my domain] with no alternate names.
/etc/univention/ssl/ucs-sso.[my domain]/cert.pem does specify:
CN=ucs-sso.[my domain]/emailAddress=ssl@[my domain]
so it appears to have been generated correctly, but the web server is serving the wrong certificate for the hostname. I have never edited anything in the apache2 confs, so I don’t know how this is happening.
Thanks for your help.