Alex Rivera | Logout

Is serial number a unique key for X509 certificate?

Asked 2012-02-01T22:10:20.107
37

Is certificate serial number a unique key for X509 certificate? User selects a certificate, and program stores serial number in preferences. Will the following code return the selected certificate?

public static X509Certificate2 GetCertificateBySerialNumber(string serialNumber)
{
    X509Certificate2 selectedCertificate = null;
    X509Store store = null;
    try
    {
        // get certificate from the store "My", "CurrentUser"
        store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
        store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
        X509Certificate2Collection allCertificates = (X509Certificate2Collection)store.Certificates;
        X509Certificate2Collection foundCertificates = (X509Certificate2Collection)allCertificates.Find(X509FindType.FindBySerialNumber, serialNumber, false);

        // select the first certificate in collection
        foreach (X509Certificate2 certificate in foundCertificates)
        {
            selectedCertificate = certificate;
            break;
        }
    }
    finally
    {
        if (store != null)
        {
            store.Close();
        }
    }

    return selectedCertificate;
}

UPDATE: I ended up using certificate thumbprint, as suggested by jglouie.

Edit
Report

1 Answer

21

No. For example, OpenSSL allows the user to set the serial number when creating certificates.

See: https://www.openssl.org/docs/manmaster/man1/openssl-x509.html

-set_serial n

Specifies the serial number to use. This option can be used with the -key, -signkey, or -CA options. If used in conjunction with the -CA option the serial number file (as specified by the -CAserial option) is not used.

The serial number can be decimal or hex (if preceded by 0x).

answered 2012-02-01T22:12:57.857

Your Answer