# What should I think about these unique certificate serial numbers [closed]

I was looking at the serial numbers of the certificates for www.google.com and wordpress.com. Wordpress was listed by openssl as:

04:0B:D4:F8:25:88:C5

This serial is listed as the serial for both my specific wordpress.com domain and for www.wordpress.com. A google search using the serial number as a keyword shows only my wordpress.com domain (because I pasted the serial number into one of my pages) in the results. I would expect to find other hits on Google.

The site www.google.com was listed by openssl as:

5F:BB:FC:7C:4C:6E:FF:92

That serial number, in a google search, showed up with only two listings, mine (Because I again pasted the serial number into a page) and cryptostorm.org.

I would think these numbers would have been put on the google search engine, and yield (probably) many hits.

@cpast: I'm not downvoting your answer, but I need a better one. I can see that google indexes the serial numbers and that is obvious if you type or copy the serials I've provided (above) into the google search bar. Using fingerprints as a search term, I can normally see many items in a search result.

And - I know people often cut and paste whole certificate info pages from Firefox, and put them into forum posts, where they ask "What's this?" or "Why's this?"

Additionally, the statement that nobody cares seems silly. One of the first items in the certificate is the serial, and certificate revocation lists are indexed by certificate serial numbers. Those serial numbers are very important. Your answer seems trollish. Anyone else?

@SOJPM: Serial numbers are unique within a CA. This serial number (e.g. Wordpress) - is supposedly used by hundreds of thousands of Wordpress associated domains. It should have google indexed data associated with it. Unless I have a "special" one.

@cygnusv: No offense taken.

@all: Why can I edit cpast's comment? I'm new to stackexchange. Seems odd.

@SOJPM: Thanks, and yes that's what I meant.

@truthserum: Here's the expiry:

issued on : 2014-04-14 18:09:05 expires on : 2015-10-14 11:29:26

So, it's been around awhile (if what I see is valid) and should have been the cert for a lot (millions?) of users. I'm not sure how many users WP has.

Maybe someone else can dump the cert or look at the Firefox Cert GUI - and see if the serials match what I have?

-

## closed as unclear what you're asking by Ilmari Karonen, poncho, DrLecter, SEJPM, yyyyyyyMay 19 at 23:44

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

So you're asking: "Why is this specific serial number used twice?" I'm not exactly sure if serial numbers need to be globally unique. It may be sufficient for them to be unique in the context of the issuing CA and hence it may be the case that the specified domains use different CA and hence can differentiate the certificates. –  SEJPM May 19 at 20:01
Ronald, the answer from cpast is perfectly fine. Don't take it from the wrong side, it is what it is. There aren't more hits in Google because there aren't more indexed websites that talk about it –  cygnusv May 19 at 20:07
you probably mean: "@all, why can I edit cpast's answer?..." Well, you can't really edit it. Your edits won't be applied immediately, but rather need to be reviewed by someone with 1000+ rep. If you've got 1000+ rep you can edit any question/answer without review. –  SEJPM May 19 at 20:40
The fingerprints are also short, 64-bits is not enough to really assume uniqueness. Is it? Also, these seems to expire pretty much annually, meaning new certificates will be issued regularly. –  TruthSerum May 19 at 21:02

The Wordpress certificate is used for all Wordpress domains; it is for *.wordpress.com (matching all subdomains of wordpress.com), and has wordpress.com as an alternate name (so it also works there). The Google certificate you list is only used for www.google.com; it is again something that commonly shows up (Chrome reports a different certificate for some reason).