ANF AC: Delayed CCADB reporting of 2026 ETSI audit findings
ANF AC reported that it did not submit CCADB incident reports for three findings from its 2026 ETSI audit within the timelines required by the CCADB Incident Reporting Guidelines v3.2. The delay was caused by ANF AC's incorrect belief that the findings should be reported only after the corresponding Audit Attestation Letter was publicly available. ANF AC said it became aware of the first finding on 2026-02-20 and the remaining findings on 2026-03-30, then created the three related incident reports on 2026-06-15 after receiving the AATL. The report states that no impact on certificates or subscribers was identified. ANF AC updated its incident assessment procedure to clarify that audit-finding reportability must be assessed independently of AATL publication, and it also implemented an automated weekly Bugzilla monitoring process. On 2026-07-31, ANF AC said all action items were complete and requested closure, and on 2026-08-01 CCADB issued a final call for comments before closing the report around 2026-08-07.
- ANF AC became aware of the first 2026 ETSI audit finding.
- ANF AC became aware of the remaining 2026 ETSI audit findings.
- ANF AC received the Audit Attestation Letter and created three related incident reports.
- ANF AC acknowledged the delayed reporting and opened this incident report.
- ANF AC said all action items were complete and requested closure of the report.
- Autoridad de Certificación (ANF AC) — Opened a preliminary incident report saying the 2026 ETSI audit findings were reported late under the CCADB Incident Reporting Guidelines and linked the three related bugs.
- Autoridad de Certificación (ANF AC) — Posted the full incident report, including the timeline, root cause analysis, no-certificate-impact statement, and a procedure update action item.
- Autoridad de Certificación (ANF AC) — Reported that implementation of the follow-up action item was in progress and on schedule for 2026-07-31.
- CCADB representative — Noted that the report had gone stale and reminded the CA about weekly updates unless a next-update date was requested.
- Autoridad de Certificación (ANF AC) — Said Action Item 2 was complete, all action items were completed, and requested closure of the incident report.
- CCADB representative — Issued a final call for comments or questions and said the report would be closed around 2026-08-07.