The Role of Certificate Serial Numbers in PKI

Every SSL certificate carries a serial number — a positive integer assigned by the issuing Certificate Authority. Serial numbers are less glamorous than fingerprints but play a critical role in certificate lifecycle management.

What a Serial Number Is

Per RFC 5280, a serial number must be:

• A positive integer
• Unique within a given CA (the same CA must never issue two certificates with the same serial number)
• No longer than 20 bytes (160 bits)

Modern CAs use randomly generated serial numbers of at least 64 bits to prevent predictability attacks.

How Serial Numbers Are Used

Revocation

When a certificate is revoked, the CA adds its serial number to the Certificate Revocation List (CRL) and returns it in OCSP responses. The serial number is the key that identifies which certificate has been revoked. A revoked certificate shows the certificate revoked error in browsers.

Auditing

CAs log every issuance event by serial number. If you need to investigate a certificate — when it was issued, to whom, what domains — the serial number is your reference with the CA. This matters in incident response.

Certificate Transparency

CT log searches often use serial numbers alongside domain names to identify specific certificates in the logs. See our Certificate Transparency explainer.

Serial Number vs Fingerprint

A fingerprint is globally unique — it's derived from the certificate's content and is the same regardless of which CA issued it. A serial number is only unique within one CA's namespace. For global unique identification, always use the SHA-256 fingerprint.

Reading Serial Numbers

Decode any certificate with the SSL Certificate Decoder to see its serial number in hexadecimal. The format 0A:1B:2C:3D:... is the colon-separated hex representation.