ok, as a workaround i activated implicit ssl on port 465 on my mail-server with an invalid (aka snakeoil) cert, because the machine is only a relay and not available to the public.
to do that, one has to remove the smtp_port and smtp_ssl variable via
ceph config rm mgr mgr/alerts/smtp_ssl
ceph...