Serial Number of a X.509 Certificate

Question

I am programming a Certification Authority in java for a uni class, now I don't know what's the best option for the serial number of the Certificate.

• Simple static counter from 0 to veryBigNumber
• some huge BigInt random number

Is there any good reason for choosing one over the other... or none of them??

thanks,

Answer 1

I would recommend that you use a random number, but keep a list of those issued serial numbers in a database. This will allow for two things.

1. You will never reissue the same serial number.
2. You can tell from a certificate's serial number if it is even remotely valid.

Of course #1 requires that you check against the known list on generation and to generate a new random number if a collision occurs, and #2 isn't much of anything in terms of security or validation but an interesting prospect never-the-less.

Answer 2

Technically counter from 0 to veryBigNumber is easier to implement than bigRandomNumber - because the serial numbers MUST be different.

However - you might not want to use a simple counter if you care about people knowing how many certificates you issued.