Serial numbers need to be unique for X.509 certs. But do they need to be strictly sequential or is making them equal to the time that the cert was generated sufficient?
They do not have to be sequential. Furthermore, there are some issues with using predictable serial numbers, as described in this post:
Just look at CA/Browser Forum Baseline Requirements v1.3.0, 7.1. Certificate Profile:
CAs SHOULD generate non‐sequential Certificate serial numbers that exhibit at least 20 bits of entropy.
and you will know the answer.
I am looking at the specification and it states that it has to be UNIQUE. It doesn't state it should be sequential or otherwise. Also the value is an "integer".
184.108.40.206 Serial number
The serial number is an integer assigned by the CA to each
certificate. It MUST be unique for each certificate issued by a
given CA (i.e., the issuer name and serial number identify a unique
- I agree with @pineappleman - while the specs don't spell it out - it makes sense to not have predictability in the serial numbers.
- Also an issue with timestamp is you will have to somehow ensure that 2 Certs requested at the same time do not get the same serial number.