Certsign - the Dutch government goto-CA fucked up and accidentally kinda revoked an intermediate CA certificate.
Basically everything government related is affected.
(Translation in threat)
Added books big tracker link: https://bugzilla.mozilla.org/show_bug.cgi?id=2046230
Government domain TLS certificates appear to have expired due to certSIGN error
Due to an error at the certificate authority certSIGN, the TLS certificates of various government websites appear to have been revoked. The Romanian company's Certificate Revocation List (CRL) states that the certificates of logius.nl and several municipal websites, among others, have been revoked.
The bug has been shared on Bugzilla, among others. According to Gabriel Petcu of certSIGN, the error occurred during the preparation for revoking certificates that still use a clientAuth Extended Key Usage. Servers use this key extension to verify the identity of clients.
OCSP and CRL?
There are two ways to check the status of web certificates. The Certificate Revocation List (CRL) is a list of all revoked certificates published by the issuer. The Online Certificate Status Protocol (OCSP) works in a more targeted way: the browser sends a request to the certificate authority's OCSP server asking whether the website's certificate is still valid. This method is often more reliable because it operates in real time, whereas the certificate authority updates the CRL list at specific times.
The CA/Browser Forum, a consortium of browser makers and certificate authorities, has determined that public TLS certificates may no longer contain an EKU for client authentication as of June 15. After June 15, browsers will no longer trust certificates that still have such an extension. CertSIGN had notified customers that they needed to replace their old certificate with a new one that complies with the new rules.
To give customers time to change their certificate, CertSIGN decided to update its CRL lists and the status of the Online Certificate Status Protocol 24 hours after the revocation. During the scheduling of that publication, an error occurred 'in the adjustment of the automated workflow'. As a result, the updated CRL lists were published before synchronization with the OCSP database was completed. Consequently, CRL and OCSP checks may now give different responses. This also affects Dutch websites, because KPN is the supplier of certSIGN certificates there. KPN confirms that a list was published by 'a supplier' in which 'a number of websites' were incorrectly flagged as unsafe. According to a spokesperson, the supplier has resolved the issue. Certificate check services are still showing problems with various websites, including logius.nl and eherkenning.nl.