So we have found the problem, sorry for early post, but maybe for somebody else it can be helpful:

For all the aliases stored in keystores must be used the same password, as said here:

http://www.cloudera.com/documentation/enterprise/5-7-x/topics/cm_sg_tls_browser.html

• Set -keypass to the same value as -storepass. Cloudera Manager assumes that the same password is used to access both the key and the keystore, and therefore, does not support separate values for -keypass and -storepass.

We changed these passwords so they are the same now, changed the passwords also in our external MySQL database and then restart the Cloudera Manager server and it worked fine.