ANF AC: Test Certificates Non-Compliance
This case concerns ANF AC’s test website TLS certificates for the “Test Website - Valid” and “Test Website - Revoked” URLs expiring on 2025-06-17, which violated Section 2.2 of the Baseline Requirements requiring the CA to host test web pages with valid, revoked, and expired TLS certificates at all times. The issue was initially disclosed via a third-party report, and ANF AC then published a Preliminary Incident Report and a Full Incident Report in the bug. ANF AC stated that the certificates were replaced with non-expired certificates and that monitoring was restored with alerts. In the Full Incident Report, ANF AC attributed the non-compliance to test domain monitoring checks being omitted during an infrastructure migration and to renewal of test certificates being historically tied to the audit calendar, which led to renewal being skipped. ANF AC also listed completed corrective actions, including creating a centralized certificate inventory with expiration dates, defining test website management as a recurring compliance task independent of the audit schedule, and adding a post-migration validation checklist. The report closure summary states that all action items were completed and requests closure, with a final call for comments before closure on approximately 2025-07-16.
- ANF AC’s test website TLS certificates for the Valid and Revoked test URLs expired.
- ANF AC’s test website certificate non-compliance was reported via a third-party report.
- ANF AC replaced the expired test website certificates and re-added the test domains into monitoring.
- ANF AC reported completion of action items and requested incident report closure.
- Community commenter — Opened a preliminary incident report stating that the Valid and Revoked test website certificates had expired and referenced the Baseline Requirements Section 2.2 expectations.
- Autoridad de Certificación (ANF AC) — Updated that both certificates were updated and that ANF AC was working on the full incident report.
- CCADB representative — Noted that the CA Owner response was inconsistent with CCADB.org expectations for incident report timing and content.
- Autoridad de Certificación (ANF AC) — Published the Full Incident Report describing the incident, impact, timeline, and root cause analysis.
- Autoridad de Certificación (ANF AC) — Reported completion of creating a centralized list of ANF AC certificates and their expiration dates.
- Autoridad de Certificación (ANF AC) — Reported completion of defining test website management as a recurring compliance task independent of the audit schedule and adding a control in GRC software.
- Autoridad de Certificación (ANF AC) — Reported completion of adding a post-migration validation checklist for monitoring system changes.
- Autoridad de Certificación (ANF AC) — Provided a report closure summary stating certificates were renewed, monitoring restored, corrective actions completed, and requested closure.
- CCADB representative — Issued a final call for comments or questions before the report would be closed on approximately 2025-07-16.