Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I was looking at the serial numbers of the certificates for www.google.com and wordpress.com. Wordpress was listed by openssl as:

04:0B:D4:F8:25:88:C5

This serial is listed as the serial for both my specific wordpress.com domain and for www.wordpress.com. A google search using the serial number as a keyword shows only my wordpress.com domain (because I pasted the serial number into one of my pages) in the results. I would expect to find other hits on Google.

The site www.google.com was listed by openssl as:

5F:BB:FC:7C:4C:6E:FF:92

That serial number, in a google search, showed up with only two listings, mine (Because I again pasted the serial number into a page) and cryptostorm.org.

I would think these numbers would have been put on the google search engine, and yield (probably) many hits.

@cpast: I'm not downvoting your answer, but I need a better one. I can see that google indexes the serial numbers and that is obvious if you type or copy the serials I've provided (above) into the google search bar. Using fingerprints as a search term, I can normally see many items in a search result.

And - I know people often cut and paste whole certificate info pages from Firefox, and put them into forum posts, where they ask "What's this?" or "Why's this?"

Additionally, the statement that nobody cares seems silly. One of the first items in the certificate is the serial, and certificate revocation lists are indexed by certificate serial numbers. Those serial numbers are very important. Your answer seems trollish. Anyone else?

@SOJPM: Serial numbers are unique within a CA. This serial number (e.g. Wordpress) - is supposedly used by hundreds of thousands of Wordpress associated domains. It should have google indexed data associated with it. Unless I have a "special" one.

@cygnusv: No offense taken.

@all: Why can I edit cpast's comment? I'm new to stackexchange. Seems odd.

@SOJPM: Thanks, and yes that's what I meant.

@truthserum: Here's the expiry:

issued on : 2014-04-14 18:09:05 expires on : 2015-10-14 11:29:26

So, it's been around awhile (if what I see is valid) and should have been the cert for a lot (millions?) of users. I'm not sure how many users WP has.

Maybe someone else can dump the cert or look at the Firefox Cert GUI - and see if the serials match what I have?

share|improve this question

closed as unclear what you're asking by Ilmari Karonen, poncho, DrLecter, SEJPM, yyyyyyy May 19 at 23:44

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1  
What is your specific question? "What should I think about X?" is not really something we can answer here. See our help center for more information about asking good questions. –  Ilmari Karonen May 19 at 15:20
    
So you're asking: "Why is this specific serial number used twice?" I'm not exactly sure if serial numbers need to be globally unique. It may be sufficient for them to be unique in the context of the issuing CA and hence it may be the case that the specified domains use different CA and hence can differentiate the certificates. –  SEJPM May 19 at 20:01
    
Ronald, the answer from cpast is perfectly fine. Don't take it from the wrong side, it is what it is. There aren't more hits in Google because there aren't more indexed websites that talk about it –  cygnusv May 19 at 20:07
    
you probably mean: "@all, why can I edit cpast's answer?..." Well, you can't really edit it. Your edits won't be applied immediately, but rather need to be reviewed by someone with 1000+ rep. If you've got 1000+ rep you can edit any question/answer without review. –  SEJPM May 19 at 20:40
    
The fingerprints are also short, 64-bits is not enough to really assume uniqueness. Is it? Also, these seems to expire pretty much annually, meaning new certificates will be issued regularly. –  TruthSerum May 19 at 21:02

1 Answer 1

I would think these numbers would have been put on the google search engine, and yield (probably) many hits.

This assumption is wrong. Certificate serial numbers are not indexed by common search engines, nor are they typically posted to any HTML site. Frankly, I'm not sure why you would assume they'd be indexed.

The Wordpress certificate is used for all Wordpress domains; it is for *.wordpress.com (matching all subdomains of wordpress.com), and has wordpress.com as an alternate name (so it also works there). The Google certificate you list is only used for www.google.com; it is again something that commonly shows up (Chrome reports a different certificate for some reason).

The reason you don't find any posts about them on Google is that no one really cares.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.