Subject: [pkix] Interoparability problem between RFC 5280 and EDIFACT

From: koichi sugimoto <[email-masked]>
Date: Tue, 13 Dec 2011 15:13:27 +0900

Dir Sirs,

We have now been facing a problem relating the length of serial number
in X.509 certificate.
If the serial number is more than or equal to 18 octets, some
application cannot work correctly.
It seems to be caused by EDIFACT standard.

Reference:
http://www.gefeg.com/jswg/v4/data/v4-9735-5.pdf

RFC 5280 permits the length of the certificate serial number to be up
to 20 octets.
For example, hexadecimal representation
'11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff 00 11 22 33 44'
must be acceptable.

RFC 5280 on page 18:
>   Given the uniqueness requirements above, serial numbers can be
>   expected to contain long integers.  Certificate users MUST be able to
>   handle serialNumber values up to 20 octets.  Conforming CAs MUST NOT
>   use serialNumber values longer than 20 octets.

On the other hand, EDIFACT specifies the length of the 'CERTIFICATE  REFERENCE'
must be less than or equal to 35 characters.
In this case,
'11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff 00 11 22'
cannot be accptable to EDIFACT.

I'm not sure about implementation of EDIFACT, therefore, this kind of
simple hexadecimal
representation may not be applied to.

Have you faced similar problem?
As for RFC 5280, how was the length specified?

Regards,
Koichi Sugimoto.