The CA/Browser Forum, a consortium of browser makers and certificate authorities, has determined that public TLS certificates may no longer contain an EKU for client authentication as of June 15. After June 15, browsers will no longer trust certificates that still have such an extension. CertSIGN had notified customers that they needed to replace their old certificate with a new one that complies with the new rules.

To give customers time to change their certificate, CertSIGN decided to update its CRL lists and the status of the Online Certificate Status Protocol 24 hours after the revocation. During the scheduling of that publication, an error occurred 'in the adjustment of the automated workflow'. As a result, the updated CRL lists were published before synchronization with the OCSP database was completed. Consequently, CRL and OCSP checks may now give different responses. This also affects Dutch websites, because KPN is the supplier of certSIGN certificates there. KPN confirms that a list was published by 'a supplier' in which 'a number of websites' were incorrectly flagged as unsafe. According to a spokesperson, the supplier has resolved the issue. Certificate check services are still showing problems with various websites, including logius.nl and eherkenning.nl.