ANF AC incident report: OCSP inconsistency for a CT precertificate after interrupted issuance workflow

ANF AC disclosed an incident involving a single CT precertificate that was published without a corresponding OCSP record, causing OCSP to return "does not know this certificate." The thread says the issue arose when SCT retrieval timed out, the issuance attempt was treated as failed, and a retry produced a new certificate with a different serial number. ANF AC registered the affected precertificate in OCSP on 2026-06-25, which resolved the immediate inconsistency. It then completed two corrective actions: changing the issuance workflow so the serial number is registered in OCSP before CT publication, and implementing independent end-to-end verification with alerts for missing or unexpected OCSP status. ANF AC also added automated OCSPWatch monitoring as an additional external validation layer, while stating that OCSPWatch is not its primary monitoring mechanism. On 2026-07-28, ANF AC filed a closure summary saying all action items were complete and requesting closure; CCADB then issued a final call for comments on 2026-07-29.

1. 2025-09-25 A precertificate was submitted to CT, SCT retrieval timed out, and a retry issued a new certificate with a different serial number.
2. 2026-06-25 ANF AC registered the affected precertificate in the OCSP responder, resolving the inconsistency.
3. 2026-07-09 ANF AC completed the issuance-workflow change so precertificates are registered in OCSP before CT publication.
4. 2026-07-10 ANF AC completed the independent end-to-end verification action item.
5. 2026-07-28 ANF AC filed a closure summary stating that all action items were completed and requested closure.

1. 2026-06-25 Autoridad de Certificación (ANF AC) — ANF AC posted a preliminary incident report describing the OCSP inconsistency and said it had registered the precertificate in OCSP.
2. 2026-06-25 Autoridad de Certificación (ANF AC) — ANF AC posted the full incident report with the timeline, root cause, and statement that no additional orphaned precertificates were found.
3. 2026-06-26 Autoridad de Certificación (ANF AC) — ANF AC said it had completed automated OCSPWatch monitoring as an additional alerting layer.
4. 2026-06-26 Google representative — Google asked for details on OCSPWatch polling and what internal independent monitoring ANF AC uses beyond OCSPWatch.
5. 2026-06-26 Mm representative — The commenter noted that the OCSPWatch API endpoint is undocumented/internal and that OCSPWatch is not a substitute for the CA's own monitoring.
6. 2026-06-29 Autoridad de Certificación (ANF AC) — ANF AC explained its internal OCSP monitoring and described two corrective actions: workflow changes and end-to-end verification with alerts.
7. 2026-07-09 Autoridad de Certificación (ANF AC) — ANF AC reported Action Item 1 complete and Action Item 2 in final validation.
8. 2026-07-10 Autoridad de Certificación (ANF AC) — ANF AC reported Action Item 2 complete and said all action items were completed.
9. 2026-07-28 CCADB representative — CCADB said the report had gone stale and asked ANF AC to file a Closure Report if ready.
10. 2026-07-28 Autoridad de Certificación (ANF AC) — ANF AC filed a closure summary describing the incident, root cause, remediation, and request for closure.
11. 2026-07-29 CCADB representative — CCADB issued a final call for comments or questions and said the report would be closed if no further input arrived.