Do X.509 certificate serial numbers change when a certificate is renewed?
I understand the thumbprint changes, but I am unsure about the serial number. I suspect so since it's a new cert, but if you can provide clarity and links to documentation, I would appreciate it.
Yes, they do. A renewed certificate is just a new certificate. RFC 5280 states this:
The serial number MUST be a positive integer assigned by the CA to each certificate. It MUST be unique for each certificate issued by a given CA (i.e., the issuer name and serial number identify a unique certificate).
In addition, the CA/Browser Forum Baseline requirements state this:
CAs SHALL generate non‐sequential Certificate serial numbers greater than zero (0)containing at least 64 bits of output from a CSPRNG.
This latter provision, which is stronger, was intended as a stopgap to prevent collision attacks when SHA-1 was still being used, but remains now even though SHA-1 is no longer being used. Issuing a certificate that does not meet these requirements is misissuance and can result in the CA being distrusted.
The combination of serial number + issuer of a X.509 certificate is unique. This is needed for identifying certificates for revoking purposes etc. If you generate a certificate with a different validity periods its a new certificate and therefore its assigned a new and for that issuer unique certificate number.
See rfc5280
The serial number MUST be a positive integer assigned by the CA to each certificate. It MUST be unique for each certificate issued by a given CA (i.e., the issuer name and serial number identify a unique certificate). CAs MUST force the serialNumber to be a non-negative integer.
