(Context: I'm working a process to publish a CRL periodically -- eg once every day.)

With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to be issued in a strictly serial fashion (1, 2, 3, etc) -- they function more like GUIDs. Some folks even recommend against strictly serial numbers because it implicitly reveals information about the CA's business/volume.

However, CRL's are different -- they are intended to be public, scheduled, and frequently updated/re-signed/re-checked. I'm wondering how best to generate the "X509v3 CRL Numbers" numbers, e.g.

  • Strictly serial. Store and increment a counter.
  • Use the time of generation (plus some nonce). This doesn't require a counter but does provide unique, monotonic values.
  • Random values. These are unique but not monotonic.

Relatedly, how often should one change the CRL number? Should one issue a new serial-number for every pro forma update (eg new expiration time with unchanged revocation-list) or only when there's a substantive change (eg an additional revocation).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.