Edit: The working openssl-version 1.02g-2 was not from jessie-backports. It was from an older stretch version.
Now I tried the current version 1.0.2k-1~bpo8+1 from jessie-backports: Tinyca hangs with this version, too - when creating a CA. openssl version 1.0.1t-1+deb8u6 works as expected...

