I’ve mailed with Univention about this and apparently the sso page needs some manual steps to work with Lets Encrypt. The recommended solution was to link the the config file for it into /etc/apache2/ucs-sites.conf.d/. For me it worked out of the box since I had already linked it into /etc/apache2/conf-enabled.
$ ls -la conf-enabled/openid-connect-provider.conf
lrwxrwxrwx 1 root root 46 Nov 15 13:26 conf-enabled/openid-connect-provider.conf -> ../conf-available/openid-connect-provider.conf