Incorrect OCSP Delegated Responder Certificate
PKIoverheid has issued one hell of a lot of OCSP Delegated Responders, as defined within RFC 6960, Section 2.6 and Section 4.2.2.2, without including the id-pkix-ocsp-nocheck response, as required by the Baseline Requirements, Version 1, Section 13.2.5 through Version 1.7.0, Section 4.9.9
More detailed information:
https://bugzilla.mozilla.org/show_bug.cgi?id=1649964
https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/EzjIkNGfVEE/XSfw4tZPBwAJ