I heard that there is a problem with the default certificates in WinCC OA. Where can i find more information?

In fact there is no problem with the provided default certifcates themselves.

The problem is, that some customers are using them in productive environments.
This is not allowed as we wrote in our product help or advised during our basic trainings and they should have been replaced by your own certificates.
Those default certificates - in older WinCC OA versions (3.12-3.16) -  are expiring in 2023 which will block communication.

For more information please have a look here:
Siemens Online Support or WinCC OA Portal