I have created a trust file both ways:

cat www.hellmi.de.pem > www.hellmi.de.trust
cat subca.pem >> www.hellmi.de.trust
cat ca.pem >> www.hellmi.de.trust

or

cat subca.pem > www.hellmi.de.trust
cat ca.pem >> www.hellmi.de.trust

and configured it as ssl_trusted_certificate, this did not help either. How do I create a trusted certificate for a StartCom CA?

This chain looks like this:

StartCom Certification Authority (ca.pem)
StartCom Class 1 Primary Intermediate Server CA (subca.pem)
www.hellmi.de (www.hellmi.de.pem)