On Wed, May 31, 2023 at 09:21:07PM -0400, Robert Moskowitz wrote:
> openssl rand -hex 1 > $dir/serial
Don't do that. You'll quickly create collisions.
Initialise the serial number to 1 more than the
serial number of the issuing CA, and let it be
auto-maintained thereafter.
This assumes a sound digest algorithm is used, otherwise predictable
serial numbers make it easier to mount collision attacks on the CA.
Are you sure you actually need to squeeze out every last byte?
Premature optimisation ...
--
Viktor.
