Well, currently I just let copy the certificate card to another folder with unlimited permissions. Adding every user to the Plesk user group did not work.
But of course this does not match the security requirements, because this folder has no restrictions… But at least all services can access the certificates there. Because I work with Docker, I have also not quite figured out how I can create a special group to assign the rights there only to the appropriate Docker.