Currently, generating valid, RFC 5280 conformant, serial numbers is an exercise left up to the user. As of https://go.dev/cl/400377 we enforce the 20 octet length requirement, but it looks like a lot of users don't entirely know how they should go about generating a valid serial number (in particular if people do know about the 20 octet maximum, they are not aware that serials that are 20 octets long cannot have the MSB set.)
Since there are such ambiguities about how to best do this, it would seem prudent to just provide a function which generates serials (or a method on *Certificate) that are conformant with the 5280 rules, i.e.
func GenerateSerial(rand io.Reader) (*big.Int, error)func (*Certificate) GenerateSerial(rand io.Reader) error
Currently, generating valid, RFC 5280 conformant, serial numbers is an exercise left up to the user. As of https://go.dev/cl/400377 we enforce the 20 octet length requirement, but it looks like a lot of users don't entirely know how they should go about generating a valid serial number (in particular if people do know about the 20 octet maximum, they are not aware that serials that are 20 octets long cannot have the MSB set.)
Since there are such ambiguities about how to best do this, it would seem prudent to just provide a function which generates serials (or a method on
*Certificate) that are conformant with the 5280 rules, i.e.func GenerateSerial(rand io.Reader) (*big.Int, error)func (*Certificate) GenerateSerial(rand io.Reader) error