(Context: I'm working a process to publish a CRL periodically -- eg once every day.)
With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to be issued in a strictly serial fashion (1, 2, 3, etc) -- they function more like GUIDs. Some folks even recommend against strictly serial numbers because it implicitly reveals information about the CA's business/volume.
However, CRL's are different -- they are intended to be public, scheduled, and frequently updated/re-signed/re-checked. I'm wondering how best to generate the "X509v3 CRL Numbers" numbers, e.g.
- Strictly serial. Store and increment a counter.
- Use the time of generation (plus some nonce). This doesn't require a counter but does provide unique, monotonic values.
- Random values. These are unique but not monotonic.
Relatedly, how often should one change the CRL number? Should one issue a new serial-number for every pro forma update (eg new expiration time with unchanged revocation-list) or only when there's a substantive change (eg an additional revocation).