Serial number generation is painfully complicated, especially if you want spec compliance. We've seen, over and over, that people get this wrong, even when trying to get it right.
We should provide an extremely simple way for people to get a correct serial easily. I propose that if the template passed to CreateCertificate contains a nil SerialNumber (currently an error), we will generate a conformant serial number, and add the following to the CreateCertificate documentation:
// If template.SerialNumber is nil, a serial number will be generated which
// conforms to RFC 5280, Section 4.1.2.2 using entropy from rand.
This is similar to, but somewhat different from, #52444. Either both, or just this proposal, could be implemented (the same logic would be used in both places).
Serial number generation is painfully complicated, especially if you want spec compliance. We've seen, over and over, that people get this wrong, even when trying to get it right.
We should provide an extremely simple way for people to get a correct serial easily. I propose that if the template passed to CreateCertificate contains a nil SerialNumber (currently an error), we will generate a conformant serial number, and add the following to the CreateCertificate documentation:
This is similar to, but somewhat different from, #52444. Either both, or just this proposal, could be implemented (the same logic would be used in both places).