0

Can my Root, Intermediate and SAN certificates have the same serial number?

The serial number is 00.

If the Root, Intermediate and SAN should not have same serial numbers, then should I use the random serial number which gets generated when I do not mention 00? Or, suggest me which serial numbers to use for those.

I am using OpenSSL.

2

In general, each certificate should have a unique serial number (unique from that issuing CA). This is because if you ever need to revoke them (ie put them on a Certificate Revocation List (CRL)) you will need to reference them by serial number on the CRL.

In your case, the End Entity certificate is issued by the Intermediate CA and is the only cert signed by that CA with serial number 00, so as long as you're not planning on issuing any more end entity certs, you don't have a uniqueness problem there. However both the Root cert and the Intermediate cert are signed by the Root, so you can not revoke your intermediate cert without also revoking your root.

Maybe that's not a thing you care about, but using a random number is definitely best practice. As an example of best practices, the CA/Browser Forum's Baseline Requirements for public HTTPS CAs says

CAs SHALL generate non-sequential Certificate serial numbers greater than zero (0) containing at least 64 bits of output from a CSPRNG.

7
  • Hmm... the database files are different for each of them. Does that still apply for different database files, and diffrent CRL files? Feb 4 at 15:40
  • 1
    Right, good point. Let me edit my answer. Feb 4 at 15:42
  • But, the Root cert does not have a database file. Should I create a Database file for Root also? Feb 4 at 15:47
  • The root cert also doesn't have OCSP/CRL. I do not see any other CAs like GlobalSign or LetsEncrypt do that either. The OCSP/CRL is only for intermediate and SANs Feb 4 at 15:49
  • Firefox also throws a SEC_ERROR_REUSED_ISSUER_AND_SERIAL error ... I even tried a new PC with firefox in it. I only added the Root cert to the certificates. Feb 4 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.