Hello Christian,
You're welcome! 
You could manually import the ASCS instance profile, at the transaction RZ10.
Or edit it directly at OS level, as you prefer.
You do not need to create/add/maintain a certificate for the ASCS, at STRUST.
In newer installations, the cryptolib is configured automatically. You would not need to configure anything at the ASCS, besides the HTTPS port with the parameter "ms/server_port_X".
Try adding the parameter. It will most likely work 
.
In case it doesn't, let us know!
Kind regards,
Isaías