ANF AC audit finding on CPS-referenced OCSP information URL publication; remediation completed and closure pending
This case concerns an ETSI EN 319 411-1 audit non-conformity for ANF AC’s CPS version 3.11. The audit found that the CPS referenced an OCSP-related information URL that was not published on the corporate website at the time, so the referenced web address did not resolve to the indicated information. ANF AC said the issue was limited to web publication and did not affect issued certificates, OCSP responses, or CRLs. ANF AC restored the OCSP informational page on 2026-03-30 and determined that no CPS text change was necessary because the reference again resolved correctly. As remediation, ANF AC added a Git-versioned inventory of compliance-related URLs and implemented daily monitoring with operational alerts; on 2026-07-31 it reported that this action item was complete and requested closure. CCADB then posted a final call for comments on 2026-08-01 and said the report would be closed around 2026-08-07 if there were no further questions.
- ANF AC migrated its corporate website and the OCSP informational page referenced by the CPS became unavailable at the referenced URL.
- ANF AC restored the OCSP informational page so the CPS-referenced URL resolved correctly again.
- ANF AC completed a preventive action by maintaining a Git-versioned inventory of corporate website URLs.
- Planned due date for automated daily monitoring of compliance-related URLs with operational alerts.
- ANF AC reported the monitoring action item complete and requested closure of the incident report.
- Autoridad de Certificación (ANF AC) — Filed the incident report describing the audit non-conformity, the affected CPS reference, and the restoration and preventive actions.
- Google representative — Asked ANF AC why prior corrective actions failed and whether the new URL inventory would be enforced by automation or manual review.
- Autoridad de Certificación (ANF AC) — Explained that prior corrective actions focused on legal repository documents and said automated daily monitoring with operational alerts had been added for compliance-related URLs.
- Autoridad de Certificación (ANF AC) — Reported that implementation of the additional action item was in progress and on schedule for 2026-07-30.
- CCADB representative — Marked the report stale and reminded the owner about the option to request a Next update date.
- Autoridad de Certificación (ANF AC) — Said the action item remained in progress and requested the Next update field be set to 2026-07-30.
- Autoridad de Certificación (ANF AC) — Reported the additional action item complete and asked for closure of the incident report.
- CCADB representative — Posted a final call for comments or questions and said the report would be closed around 2026-08-07 if there were none.