0

Can my Root, Intermediate and SAN certificates have the same serial number?

The serial number is 00.

If the Root, Intermediate and SAN should not have same serial numbers, then should I use the random serial number which gets generated when I do not mention 00? Or, suggest me which serial numbers to use for those.

I am using OpenSSL.

Improve this question

1 Answer 1

Reset to default
2

In general, each certificate should have a unique serial number (unique from that issuing CA). This is because if you ever need to revoke them (ie put them on a Certificate Revocation List (CRL)) you will need to reference them by serial number on the CRL.

In your case, the End Entity certificate is issued by the Intermediate CA and is the only cert signed by that CA with serial number 00, so as long as you're not planning on issuing any more end entity certs, you don't have a uniqueness problem there. However both the Root cert and the Intermediate cert are signed by the Root, so you can not revoke your intermediate cert without also revoking your root.

Maybe that's not a thing you care about, but using a random number is definitely best practice. As an example of best practices, the CA/Browser Forum's Baseline Requirements for public HTTPS CAs says

CAs SHALL generate non-sequential Certificate serial numbers greater than zero (0) containing at least 64 bits of output from a CSPRNG.

Improve this answer
7
  • Hmm... the database files are different for each of them. Does that still apply for different database files, and diffrent CRL files?
    – Example person
    Feb 4, 2021 at 15:40
  • 1
    Right, good point. Let me edit my answer.
    – Mike Ounsworth
    Feb 4, 2021 at 15:42
  • But, the Root cert does not have a database file. Should I create a Database file for Root also?
    – Example person
    Feb 4, 2021 at 15:47
  • The root cert also doesn't have OCSP/CRL. I do not see any other CAs like GlobalSign or LetsEncrypt do that either. The OCSP/CRL is only for intermediate and SANs
    – Example person
    Feb 4, 2021 at 15:49
  • Firefox also throws a SEC_ERROR_REUSED_ISSUER_AND_SERIAL error ... I even tried a new PC with firefox in it. I only added the Root cert to the certificates.
    – Example person
    Feb 4, 2021 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .