Certificate transparency: Why fully random serial numbers and seperate hosting?

The incrementing serial prefix was originally a solution to allow people to quickly enumerate all the certificates we issued, as you’ve mentioned @My1. Unfortunately this design decision added a number of points of failure in Boulder that were really unnecessary.

Instead of attempting to maintain this solution with a somewhat flaky fix we chose to instead submit all issued certificates to CT logs and use a (almost) fully random serial. This adds a slight hurdle to people who may want to find all our certs but it is one of the main functions of CT and removes a set of problems we bound ourselves to with the incremental approach that have greatly simplified our design.

4 Likes