Serial Number of a X.509 Certificate
java, pki, security, x509, x509certificate
Solution
I would recommend that you use a random number, but keep a list of those issued serial numbers in a database. This will allow for two things.
- You will never reissue the same serial number.
- You can tell from a certificate's serial number if it is even remotely valid.
Of course #1 requires that you check against the known list on generation and to generate a new random number if a collision occurs, and #2 isn't much of anything in terms of security or validation but an interesting prospect never-the-less.
Problem
I am programming a Certification Authority in java for a uni class, now I don't know what's the best option for the serial number of the Certificate. - Simple static counter from 0 to veryBigNumber - some huge BigInt random number Is there any good reason for choosing one over the other... or none of them?? thanks,