Concerning the online manual 
["Univention Corporate Server: Extended domain services documentation"](https://docs.software-univention.de/domain-4.2.html#ext-dom-unix)

Section 2.4 reads:

In the standard setting, only TLS-secured access is possible on UCS-LDAP servers. The accessing Unix system must therefore use the root certificate of the UCS-CA. The certificate can be found on the master domain controller in the file **/etc/univention/ssl/udsCA/CAcert.pem** and can be copied into any directory, e.g., /etc/ucs-ssl/.


There is NO /etc/univention/ssl/udsCA directory on my newly installed UCS server
Presumably, it should be 

/etc/univention/ssl/ucsCA/CAcert.pem
                     ^

instead of

/etc/univention/ssl/udsCA/CAcert.pem
                     ^