Ok here it is, I found the difference.

I created a "ssl.defs" file in "/etc/osso-af-init/". I will attach the file.
Furthermore I edited af-defines.sh in the same folder.

Add a new line around line 160(were other *.defs get loaded):
After the changes restart the N900.
Congratulation now you are finished and all console tools like openssl, ssh and wget should work without -CApath.

I think I did it when I had some problems with other openssl in the past, the date of the file is 12.04.2018 and now it helps.