ANF AC: 2026 Audit Report Finding 2 out of 3 — CPS OCSP URL not published
This case reports an audit finding for ANF AC related to its Certification Practice Statement (CPS). During the annual ETSI EN 319 411-1 conformity assessment audit, it was identified that the CPS (OID 1.3.6.1.4.1.18332.1.9.1.1, version 3.11) contained a URL for additional OCSP information that was not published on the corporate website at the time. The finding was treated as a non-conformity against ETSI EN 319 411-1, REQ REV-6.2.4-01, because the CPS referred users and subscribers to a web address that did not resolve to the indicated information. ANF AC stated the issue was documentary and related to web publication, and that no issued certificates, OCSP responses, or CRLs were affected. ANF AC restored the OCSP informational page on 2026-03-30 so the URL referenced in the CPS resolved correctly again, and it concluded no CPS text modification was necessary. The preventive action completed on 2026-04-24 included updating and maintaining a Git-versioned inventory of corporate website URLs to improve coordination between teams.
- ANF AC migrated its corporate website, and the OCSP informational page referenced by the CPS URL was no longer published.
- ANF AC restored the OCSP informational page so the CPS-referenced URL resolved correctly again after the audit identified the issue.
- ANF AC completed preventive action by updating and maintaining a Git-versioned inventory of corporate website URLs.
- yulier.nunez@anf.es — Filed a full incident report describing an ETSI audit non-conformity where the CPS referenced an OCSP information URL that did not resolve to the intended content, and documented restoration and preventive actions.