I'm designing an API authentication mechanism similar to the one AWS use. As part of that, I need to look up which public key belongs to which user to verify. The public keys come from x509 certificates that we issued to user, so I know they have both serial number and subject key identifier (SKID). Should I use the serial number or the SKID as a unique ID?
The advantage of SKID is that it's a hash of the public key so it can be independently computed from the certificate. However, the serial number is simply an integer, much easier to deal with.