Sequential Serial Numbers v1

Overview

The Sequential Serial Numbers v1 (SSNv1) is mainly described in Random Certificate Serial Numbers v1.

Current Range

For request IDs, the current range is stored in CS.cfg as decimal numbers:

• dbs.beginRequestNumber

• dbs.endRequestNumber

• dbs.requestCloneTransferNumber

• dbs.requestIncrement

• dbs.requestLowWaterMark

For certificate serial numbers, the current range is stored in CS.cg as hexadecimal numbers:

• dbs.beginSerialNumber

• dbs.endSerialNumber

• dbs.serialCloneTransferNumber

• dbs.serialIncrement

• dbs.serialLowWaterMark

Next Range

For request IDs, the next range is stored in the nextRange attribute in ou=ca,ou=requests,dc=ca,dc=pki,dc=example,dc=com as decimal.

For certificate serial numbers, the next range is stored in the nextRange attribute in ou=certificateRepository,ou=ca,dc=ca,dc=pki,dc=example,dc=com as decimal too (not hexadecimal).

Known Issues

The serial numbers issued using SSNv1 are not contiguous. Sometimes there are gaps between the serial numbers.

For example, suppose a CA is configured with the following range:

• size: 18 (0x12)

• increment: 18 (0x12)

• minimum: 9 (0x9)

The range progression will look like the following:

Event	Current Range	Current Size	Next Range	Allocated Range	Allocated Size
Initial range	1 - 18 (0x1 - 0x12)	18	13 (0xd)
Range allocation	1 - 18 (0x1 - 0x12)	18	31 (0x1f)	13 - 30 (0xd - 0x1e)	18
Range switch	19 - 36 (0x13 - 0x24)	18	31 (0x1f)	13 - 30 (0xd - 0x1e)	18
Range allocation	19 - 36 (0x13 - 0x24)	18	49 (0x31)	31 - 48 (0x1f - 0x30)	18
Range switch	49 - 66 (0x31 - 0x42)	18	49 (0x31)	31 - 48 (0x1f - 0x30)	18

There are two issues:

The first problem is, the initial Next Range is incorrectly set to 13 (0xd) whereas it should have been 19 (0x13). This is caused by a bug in pki-server ca-range-update (SubsystemRangeUpdateCLI.java) that parses the dbs.endSerialNumber as a decimal instead of hexadecimal.

The second problem is, the serial numbers jumps from 36 (0x24) to 49 (0x31). This is caused by a bug in Repository.checkRanges() that parses the Next Range as hexadecimal instead of decimal.