Tadamon Prévoyance: since midnight, no VPN, no directory, and the claims API returns 503

Tadamon Prévoyance is a health mutual based in Rabat (310,000 members, 14 branches). Its information system is hybrid:

• at headquarters, the core system core-sinistres01, the OpenLDAP directory ldap01 (LDAPS, port 636) and the OpenVPN gateway vpn-gw01 for the 420 remote agents;
• in AWS (eu-west-3), the Envoy gateway gw-sinistres, which exposes the claims API to partner clinics (api.tadamon-prevoyance.ma) and calls the core system over mTLS through the site-to-site VPN.

All these exchanges rely on the internal PKI: an offline root CA “Tadamon Root CA R1” and an intermediate CA “Tadamon Issuing CA G1” hosted on pki01. The certificate chains are distributed everywhere by the Ansible role pki-chaine (repository ~/infra-pki).

Since 00:00, three alerts have gone off in a burst. At 07:00, the branches open: advisers can no longer authenticate (directory), remote workers are stuck at the VPN and clinics can no longer declare the weekend's hospital admissions. The CISO, Karim Alaoui, has already suggested “turning off TLS verification in the meantime”; the operations manager, Omar Bennani, wants to “restart everything”.

You are Hajar, the on-call engineer, on poste-astreinte (AWS CLI v2, profile tadamon-prod, Ansible repository, SSH access to pki01, ldap01 and vpn-gw01). The alert summary is in ~/INC-3512/alertes.txt.