USER PROBLEM
Since ACS is an official Red Hat operator, OpenShift should automatically trust Central CA certificate. This would be useful whenever an OCP component needs to connect to central. Example: in this Prometheus configuration [0] to access custom metrics, I had to manually trust ca certificate, with all the disadvantages that come with it (more complicated configurations, certificate expiration management, ...)

[0] https://access.redhat.com/solutions/7139236

CONDITIONS
Always.

ROOT CAUSE
Central CA certificate is not in OCP trust bundle.

FIX
The only workaround at the moment is to manually trust Central CA certificate for each component connecting to ACS.