As far as X.509 is concerned, the Common Name is not mandatory. However, a number of systems will use the CN for display purposes, e.g. most "certificate manager" GUI in Windows. Therefore, it is recommended, if only for ease of sysadmin tasks, to include reasonably precise CN in certificates.
If you want to, from an application, pinpoint a specific certificate, then the good identifier to use is the "thumbprint", which really is a hash of the certificate. As long as the hash function is collision-resistant (Microsoft uses SHA-1, which is still quite robust in that respect), no two distinct certificates will exhibit the same thumbprint.
The "standard X.509" method of referencing a specific certificate is to use the pair issuerDN + serial number. Only the combination of both values is (supposedly) unique; serial numbers alone don't cut it. Mind that I am talking about the issuer's name, not the subject's; and this is the whole DN, not just the CN part of it. Moreover, it is allowed for a certificate to have an empty
issuerDN provided it also contains an
Issuer Alt Name extension with the complete DN. This means that properly using the issuer+serial pair can be somewhat complex. The thumbprint is easier.