did you run univention-app update-certificates on the ucs server to renew the app certificate after renewing the ucs root cert ?
univention-app update-certificates
see: