(FYI: I'm using Ubuntu 18.04 Desktop although I don't think my question is platform-dependent.)
I read the article Scalable and secure access with SSH and it says:
... if you want to use revocation lists, unique serial numbers are a requirement.
But by reading
ssh-keygen manual page, I didn't seem to find a way to guarantee the uniqueness of the serial numbers. It looks to me it's completely managed by the CA, i.e., the CA needs to figure out a way (either their own database or just a spreadsheet) to manage the serial numbers. I'm wondering if my understanding is correct or not.
My second question is: Why is it required to use unique serial numbers for revocation? I'm asking because the section "KEY REVOCATION LISTS" of
ssh-keygen manual page says:
A KRL specification consists of lines containing ONE OF the following directives followed by a colon and some directive-specific information.
Then the manpage lists the directives that can be used:
- serial: serial_number[-serial_number]
- id: key_id
- key: public_key
- sha1: public_key
The words sound like that, if serial numbers are not unique, CA can still use other directives to revoke the certificates. The manual page says "ONE OF", not "ALL OF".