Replying to myself again, i managed to "solve" this.
in /etc/ovirt-imageio/conf.d/50-engine.conf it uses the key_file and cert_file of the
apache by default.
For the CA cert it is indeed using the apache-ca.pem as expected (?), it seems to use the
same CA when trying to reach the VDSM imageio daemon running on each host for obvious
reasons those are two different CA, the apache-ca.pem is used by the Engine
"frontend".
Changing the ca_file to /etc/pki/ovirt-engine/ca.pem and restart the imageio daemon on the
ovirt-engine solved this issue.
The information here:
http://ovirt.github.io/ovirt-imageio/overview.html is misleading.