We have identified and fixed the issue. There was a state mismatch between our infrastructure as code (IaC) and our clusters. This resulted in a missing secret causing the certificate management to fail.

Planned improvements:
- synchronise the IaC more often
- alerts on almost expiration of certificates (only webchat and portal were missing this alert)
- improved on-call schedule
- regular manual check on certificate status

Our portal and webchat are currently down due to an expired certificate. Our automated certificate management is failing without us noticing. We will fix this asap.