Certificate Serial Number (Serial number)

The serial number is a field in every X.509 certificate. RFC 5280 requires it to be a positive integer of at most 20 octets and unique among all certificates issued by the same CA, so the pair of issuer and serial names exactly one certificate. Revocation relies on this: a CRL lists revoked serial numbers, and an OCSP request asks about one serial from one issuer.

Why it matters

The Baseline Requirements require serial numbers to be non-sequential, greater than zero and to contain at least 64 bits of output from a cryptographically secure random number generator. Unpredictable serials make it hard for an attacker to control the exact data a CA signs, a weakness exploited in a 2008 MD5 collision attack that produced a rogue CA certificate. CAs have had to replace large numbers of certificates when their serial generation fell short of this rule, so the serial is a real compliance item, not just a label.

Example

openssl x509 -in cert.pem -noout -serial -issuer

OpenSSL prints the serial in hexadecimal; browsers and CT search tools often show the same value with colon separators.

Common misconceptions

• Serial numbers are globally unique. They are unique only per issuer; two CAs can issue the same serial.
• A renewed certificate keeps the same serial. Every issuance gets a new serial, even with the same key and names.
• The serial number and the fingerprint are the same thing. The serial is assigned by the CA inside the certificate; the fingerprint is a hash computed over the whole certificate.