Subject: serialNumber Attribute

From: [email-masked]
Date: Wed, 17 Nov 2004 14:02:30 +0100

Hi,

Not having found a reference specifies in the RFC, I call upon you to solve a
problem currently met by certain Frecnh CA. 

 Certificates were emitted with in the DN a serialNumber attribute containing a
value different from the serialNumber contained in the certificate.

 This is correct ? 

I don't find reference in RFC3280 for attribute serialNumber in certificate, it
is subjected to the conditon of the paragraph 4.1.2.2 "Serial number" ?

Thanhs Yannick

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Wed, 17 Nov 2004 14:58:48 +0100

>value different from the serialNumber contained in the certificate.
There is no relationship at all between the two values, there is no 
reason to expect they would identical.

>is subjected to the conditon of the paragraph 4.1.2.2 "Serial number" ?
The serialNumber attribute that you can use in the DN is defined in X.520.
Inside RFC3280 it's referenced as X520SerialNumber, but RFC3280 doesn't 
say much about it.

RFC 2256 has a little more information about it.
In PKI usage, this attribute is supposed to be used to avoid duplicated 
DN for two users, when the other attributes present in the DN are not 
sufficient.
It can have any value adequate for this.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 17 Nov 2004 09:43:49 -0500

>is subjected to the conditon of the paragraph 4.1.2.2 "Serial number" ?

The serialNumber attribute that may appear in a DN is in no way 
related to the serial number value that appears in the cert.  Sorry 
that the names cause confusion, but the text defining each of these 
values in a cert is pretty clear.

Steve