# What Is Certificate Serial Number (Serial number)?

> Certificate serial numbers are positive integers a CA assigns to each certificate; combined with the issuer name, they uniquely identify a certificate.

Source: https://ssl.sh/glossary/certificate-serial-number/
Last updated: 2026-11-10

The serial number is a field in every [X.509](https://ssl.sh/glossary/x509/) certificate. RFC 5280 requires it to be a positive integer of at most 20 octets and unique among all certificates issued by the same CA, so the pair of issuer and serial names exactly one certificate. Revocation relies on this: a [CRL](https://ssl.sh/glossary/crl/) lists revoked serial numbers, and an [OCSP](https://ssl.sh/glossary/ocsp/) request asks about one serial from one issuer.

## Why it matters
The Baseline Requirements require serial numbers to be non-sequential, greater than zero and to contain at least 64 bits of output from a cryptographically secure random number generator. Unpredictable serials make it hard for an attacker to control the exact data a CA signs, a weakness exploited in a 2008 MD5 collision attack that produced a rogue CA certificate. CAs have had to replace large numbers of certificates when their serial generation fell short of this rule, so the serial is a real compliance item, not just a label.

## Example
```bash
openssl x509 -in cert.pem -noout -serial -issuer
```

OpenSSL prints the serial in hexadecimal; browsers and CT search tools often show the same value with colon separators.

## Common misconceptions
- **Serial numbers are globally unique.** They are unique only per issuer; two CAs can issue the same serial.
- **A renewed certificate keeps the same serial.** Every issuance gets a new serial, even with the same key and names.
- **The serial number and the fingerprint are the same thing.** The serial is assigned by the CA inside the certificate; the fingerprint is a hash computed over the whole certificate.

## Related terms

- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [CRL](https://ssl.sh/zh/glossary/crl/): CRL 是由 CA 签名并定期重新发布的证书吊销列表，列出它在证书到期前就已吊销的证书序列号。
- [OCSP](https://ssl.sh/zh/glossary/ocsp/): OCSP 是 RFC 6960 定义的在线证书状态协议，客户端可以向 CA 的响应服务器查询某一张证书当前是有效、已吊销还是未知。
- [证书指纹](https://ssl.sh/zh/glossary/certificate-fingerprint/): 证书指纹是对证书 DER 编码计算出的哈希值（通常用 SHA-256），用来唯一标识一张证书，它本身并不存储在证书里。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。