← Autoridad de Certificación (ANF AC) cases
Bugzilla #1970567
Policy Compliance
ANF AC: Finding #4 ETSI Audit - Missing one Revocation circumstance on CPS
RESOLVED
FIXED
Autoridad de Certificación (ANF AC)
AI Summary
The ANF AC faced a compliance issue during an ETSI audit due to the omission of an explicit clause in their Certification Policies and Practices document regarding certificate revocation when cryptography no longer ensures the binding between the subject and its public key. Although the compliance team believed this was implicitly covered in other sections, external auditors required explicit mention. The issue was identified on February 14, 2025, and resolved by updating the document on February 20, 2025. No certificates were affected as this was a documentation issue.
Chronology
- Publication of version 3.9 of the Certification Policies and Practices document without the explicit revocation clause.
- Non-compliance detected by external auditors during the annual conformity assessment audit.
- Publication of version 3.10 of the Certification Policies and Practices document, adding the explicit revocation clause.
Participants
Yulier Nuñez
CCADB Incident Reporting
External References
Similar Local Cases
ANF AC: Test Certificates Non-Compliance
ANF AC: Finding #2 ETSI Audit - Information security policy not updated on the website
ANF AC: Finding #1 ETSI Audit - Missing log retention period in Terms and Conditions v1.9
ANF AC: Finding #3 ETSI Audit - Improve documental explanation revocation request >24h on CPS
ANF: Missing log retention period in Terms and Conditions v1.9
Certigna: Finding #1 ETSI Audit – French translation missing from S/MIME CP/CPS
Firmaprofesional: 2019 audit Finding #1 - 6.2 Identification and Authorization
KIR: Intermediate CA - SZAFIR Trusted CA4 - Certificate Policies extension - non-compliance