ETSI EN 319 411-1 How should certificate authorities handle certification audit evidence under ETSI EN 319 411-1

Start with the audit boundary. The evidence file should identify the TSP or CA service being assessed, the applicable certificate policy, the CPS version, the certificate profiles and policy OIDs in use, the assessment period, and whether registration, certificate generation, dissemination, revocation management, revocation status, and subject-device provisioning are in scope.

Then map the file to requirement identifiers and operating records. EN 319 411-1 requirement IDs identify registration (REG), certificate generation (GEN), revocation (REV), certificate status (CSS), dissemination (DIS), subject-device provisioning (SDP), and general requirements (OVR). Informative Annex B points to the separate ETSI TR 119 411-4 conformity assessment checklist. An auditor should be able to follow each sampled requirement from the CP/CPS commitment to the retained record that proves operation during the assessment period.

The core evidence should prove that the certificate service operated as documented. For registration, keep application and identity-validation records, subscriber-agreement evidence, the accepting entity, validation method, RA handoff, and the location of supporting documents. For certificate lifecycle events, keep certificate requests, accuracy and authorization checks, issuance links to registration, renewal, re-key, modification, and dissemination evidence.

For revocation and status services, retain authenticated revocation requests, event reports, resulting actions, timing evidence, CRL or OCSP publication records, and exception records where confirmation or publication timing could not be met. For CA keys, keep key lifecycle logs and ceremony evidence, including the ceremony requirements and collected evidence for CA key generation or installation.

Package the file so the assessor can sample without reconstructing the service from scratch. Use one index for scope and documents, one matrix for EN 319 411-1 requirement IDs, and separate folders for registration, certificate lifecycle, revocation/status, CA key management, audit logs, records archival, supplier or RA evidence, and corrective actions.

Retention should be explicit by record class. Clause 6.4.6 requires the TSP to retain CA-managed key-lifecycle logs and the documentation identified in clause 6.3.4 for at least seven years after any certificate based on those records ceases to be valid. Do not apply that sentence automatically to every audit artifact: show the ETSI requirement, disclosed terms, legal or scheme rule, archive location, integrity control, and access path that govern each record class.