Can create a cert with no serial number?
openssl-users at dukhovni.org
Thu Jun 1 01:55:48 UTC 2023
On Wed, May 31, 2023 at 09:21:07PM -0400, Robert Moskowitz wrote:
> openssl rand -hex 1 > $dir/serial
Don't do that. You'll quickly create collisions.
Initialise the serial number to 1 more than the
serial number of the issuing CA, and let it be
This assumes a sound digest algorithm is used, otherwise predictable
serial numbers make it easier to mount collision attacks on the CA.
Are you sure you actually need to squeeze out every last byte?
Premature optimisation ...
More information about the openssl-users