ANF AC: Finding #1 ETSI Audit - Missing log retention period in Terms and Conditions v1.9
ANF AC reported a CCADB compliance issue identified during an ETSI EN 319 401 audit. The Terms and Conditions document (v1.9) for ANF AC’s qualified trust services did not explicitly define the event log retention period for qualified website authentication certificates (TLS/SSL OV/EV/QWAC). ANF AC stated that the retention period was specified in the corresponding CPS and CP, but its omission from the Terms and Conditions resulted in a non-conformity under ETSI EN 319 401 Section 6.2 (REQ-6.2-02). ANF AC said the non-compliance began with the document publication on January 27, 2024 and was identified on March 13, 2025, with the non-conformity ending on March 14, 2025. ANF AC reported that issuance was not stopped because the deficiency was limited to the wording of the Terms and Conditions document, which was updated to explicitly include log retention for all services. The corrective action included adding a centralized, harmonized Terms and Conditions section specifying a 15-year log retention period and implementing a revision workflow with mandatory tracked change prior to document approval. The bug was marked RESOLVED with resolution FIXED.
- ANF AC published Terms and Conditions document v1.9 that omitted the event log retention period for QWAC-related services.
- An ETSI EN 319 401 audit identified the non-conformity in the Terms and Conditions regarding event log retention.
- ANF AC corrected the Terms and Conditions to explicitly include the event log retention period for all services.
- The bug was resolved as FIXED.
- Autoridad de Certificación (ANF AC) — Pablo Díaz opened the incident report describing ETSI audit Finding #1: the Terms and Conditions v1.9 lacked an explicit event log retention period for QWAC-related certificates, and stated the corrective update and prevention workflow.
- CCADB representative — The CCADB incident reporting account stated that Bug 1969839 was marked as a duplicate of this bug.
- CCADB representative — The CCADB incident reporting account issued a final call for comments before closure around 2025-07-14.