When attempting to connect to bgo, firefox and chromium both give errors that the (new) certificate is not trusted as the issuer is unknown,
The certificate is for *.bugs.gentoo.org - obviously this doesn't match the hostname bugs.gentoo.org
(In reply to Patrick Lauer from comment #1) > The certificate is for *.bugs.gentoo.org - obviously this doesn't match the > hostname bugs.gentoo.org AltName says bugs.gentoo.org and *.bugs.gentoo.org, there is all OK. Issuer "GlobalSign nv-sa" is not in trusted datastore.
The altnames are indeed fine. There was an old certificate chain left from before the reissuing. Fix is pushed, waiting for the next cfengine run in 8 minutes.