We think we have found to issue.
Die Certificate was initially generated for a different hostname.
Paho Client does not care about it (it seems to use a different SSL implementation(?)).
The SSL lib, hivemq client is using seems to check if the broker hostname is the right one (from the certificate) and throws this error.
So we need dedicated certificates (and therefore JKS files) für each Hostname DNS we want to connect to…