I'm looking for a job shoveling pig shit as we speak.

What genuinely pisses me off is that this isn't noted on their status page, nor is it indicated at all when you, I dunno, revoke and generate certs repeatedly trying to solve a problem you didn't fucking cause.

Are you serious Apple?

OpenSSL can't validate the cert because it contains a critical extension it doesn't recognize — specifically 1.2.840.113635.100.6.27.3.2, which is an Apple-proprietary OID marked as critical. Per X.509 rules, if a client encounters an unrecognized critical extension, it must reject the cert.

That said, this is likely intentional on Apple's part — browsers and Apple's own TLS stack (SecureTransport/Network.framework) almost certainly know how to handle this extension. It's a private Apple CA (Apple Server Authentication CA) signing an Apple-internal service endpoint, so it's designed to work within Apple's ecosystem rather than with generic OpenSSL.

In practice:

  - Works fine in Apple clients (Safari, curl on macOS using the system TLS stack, iOS apps)                                                          
  - Fails with raw OpenSSL or other non-Apple TLS implementations                                                                                     
  - Not a misconfiguration — it's Apple intentionally using a proprietary critical extension on their private PKI

Full disclosure, I operate a product that compares official outage acknowledgment to actual outage impact times. (Which I won't mention to avoid self-promotion.)

For this specific incident, I saw the alert come across my Slack at 19:02 UTC. We received over 100 reports of this outage before the official acknowledgement was posted by Apple on their status page at 21:37 UTC.

Shortly after their acknowledgment, the reports fizzled out and then Apple marked the incident as resolved about 20 minute later.

The whole outage lasted about 4 hours from first report to last and wasn't acknowledged by Apple until 3.5 hours into it.