ANF AC: 2026 audit report finding on CPS documentation for OCSP/CRL timing discrepancies

This case concerns an ETSI EN 319 411-1 conformity assessment audit finding for ANF AC. The audit found that CPS version 3.12 did not document the origin of potential timing differences between OCSP and CRLs, or how status information should be interpreted if the two mechanisms disagreed. ANF AC said the issue was documentary only and did not affect issued certificates, OCSP responses, or CRLs. ANF AC corrected the CPS by issuing version 3.13 on 2026-03-30, adding guidance that OCSP prevails in the event of a temporal discrepancy and that both mechanisms are expected to converge. The incident report was later given a final call for comments, and the bug is now resolved fixed.

1. 2026-03-24 CPS version 3.12 entered into force without documenting OCSP/CRL timing-discrepancy handling.
2. 2026-03-30 The annual ETSI EN 319 411-1 audit identified the CPS non-conformity and ANF AC issued CPS version 3.13 as a corrective update.
3. 2026-05-05 ANF AC completed a preventive peer review of ETSI requirements transcribed into its GRC system.

1. 2026-06-15 Autoridad de Certificación (ANF AC) — Submitted the full incident report describing the audit finding, the CPS correction, and the preventive peer review action.
2. 2026-07-20 CCADB representative — Posted a final call for comments or questions and said the incident report would be closed around 2026-07-27 if there were no further comments.