duplicate Serials after Upgrade 2.1.0

[funked00]

Hi,

after opening my V 1.3.1 DB with version 2.10 the DB was converted. When signing the first CSR there was an error mesage: "Failed to retrieve unique random serial". In the next try there was no error message and the certificate was generated. But with a serial already in the database.

Best regards,
Daniel

[chris2511]

Did the certificates with identical serials have the same issuer?
It is only necessary for certificates issued by the same issuer to have unique serials.

The issue is caused by to narrow random serials (8 bit). It should be 64 bit.

[funked00]

Yes, the new certificate was signed by the same issuer. The serial was a two digit hex. I noticed the problem because this serial was on the crl already.

[chris2511]

Is the Serial also listed in the "CA -> Manage revocations" context menu of the CA?
Because serials on the CRL are also checked and refused when generating a new random serial.
But therefore they must be known by XCA.
I checked this functionality right know and seems to work.