ANF AC: 2026 Audit Report Finding 3 out of 3 (CPS missing OCSP/CRL timing-discrepancy documentation)
This case reports an audit finding from ANF AC’s annual ETSI EN 319 411-1 conformity assessment audit. The audit identified that ANF AC’s CPS (OID 1.3.6.1.4.1.18332.1.9.1.1, version 3.12, dated 2026-03-24) did not document the origin of potential timing differences between OCSP- and CRL-based certificate status checking mechanisms, nor how to interpret status information if temporal discrepancies occur. The finding was treated as a non-conformity against ETSI EN 319 411-1 requirement CSS-6.3.10-09A. ANF AC stated the finding was documentary only and did not affect any issued certificates, OCSP responses, or CRLs. ANF AC became formally aware of the incident on 2026-03-30 and updated the CPS by issuing version 3.13 on 2026-03-30, adding in Section 4.10.1 that in a temporal discrepancy OCSP prevails and both mechanisms are expected to converge. ANF AC also completed a preventive peer review of ETSI requirements transcribed into its GRC system on 2026-05-05.
- CPS version 3.12 entered into force without documenting OCSP/CRL timing-discrepancy origin and interpretation.
- During the annual ETSI EN 319 411-1 audit, ANF AC was found non-conformant to CSS-6.3.10-09A and updated the CPS by issuing version 3.13.
- ANF AC completed a preventive peer review of ETSI requirements transcribed into its GRC system.
- yulier.nunez@anf.es — Posted the full incident report describing the audit finding that the CPS did not document OCSP/CRL timing differences and the corrective CPS update to version 3.13.