The main problem here was, that when we set operationTimeout to 30s and delete the cluster certificate, only one from three ZK pods was rolled, the whole rolling update stucked and nothing else happened. When I prolonged the operationTimeout to 5 minutes, rolling update finish successfully without any problem.

Started by: https://github.com/strimzi/strimzi-kafka-operator/issues/3913