[pkix] Re: [Technical Errata Reported] RFC3280 (9097)

Russ Housley <housley@vigilsec.com> Mon, 10 August 2026 18:42 UTC

Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\))
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <178638013060.15.1586891668281190866@rfc-editor.org>
Date: Mon, 10 Aug 2026 14:42:42 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <12F9F721-4119-4DA0-B668-B2CD5E5BA075@vigilsec.com>
References: <178638013060.15.1586891668281190866@rfc-editor.org>
To: rfc-editor@rfc-editor.org
Message-ID-Hash: ZSRAPHPW6FNMXGXKKBLTVNKVHYS6Y7VQ
CC: tim.polk@nist.gov, dsolo@alum.mit.edu, Chris Inacio <stndrds-inacio@andrew.cmu.edu>, 1174804262@qq.com, IETF PKIX <pkix@ietf.org>
Precedence: list
Subject: [pkix] Re: [Technical Errata Reported] RFC3280 (9097)
Archived-At: <https://mailarchive.ietf.org/arch/msg/pkix/YUo7UD_dTHxzbGBJvLo-FzF48TM>

RRC 3280 is obsolete; it has been replaced by RFC 5280.  I do not see any reason to process this errata.

Russ

> On Aug 10, 2026, at 12:42 PM, rfc-editor@rfc-editor.org wrote:
> 
> The following errata report has been submitted for RFC3280,
> "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile"
> 
> --------------------------------------
> You may review the report below and at:
> https://errata.rfc-editor.org/eid9097/
> 
> --------------------------------------
> Type: Technical
> Reported by: Peng Yuan <1174804262@qq.com>
> 
> Section 4.1.2.2 says:
> 
> Original Text
> -------------
> The serial number MUST be a positive integer assigned by the CA to
>   each certificate.  It MUST be unique for each certificate issued by a
>   given CA (i.e., the issuer name and serial number identify a unique
>   certificate).  CAs MUST force the serialNumber to be a non-negative
>   integer.
> 
> Corrected Text
> --------------
> The serial number MUST be a positive integer assigned by the CA to
>   each certificate.  It MUST be unique for each certificate issued by
>   a given CA (i.e., the issuer name and serial number identify a
>   unique certificate).  CAs MUST force the serialNumber to be
>   positive integer.
> 
> Notes
> -----
> r/non-negative/positive
> The text contains inconsistent requirements for the certificate
> serialNumber. The first sentence requires the serial number to be a
> positive integer, which excludes zero. However, the last sentence
> requires CAs to force the serialNumber to be a non-negative integer,
> which permits zero. These two requirements are contradictory and may
> cause ambiguity for certificate issuers regarding whether a serial
> number of zero is permitted. The last sentence should use "positive
> integer" instead of "non-negative integer" to maintain consistency
> within this section.
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". Please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> will log in to change the status and edit the report, if necessary.
> 
> --------------------------------------
> RFC3280 (draft-ietf-pkix-new-part1)
> --------------------------------------
> Title               : Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
> Publication Date    : May 2002
> Author(s)           : R. Housley, W. Polk, W. Ford, D. Solo
> Category            : Proposed Standard
> Source              : pkix (sec)
> Stream              : IETF
> Verifying Party     : IESG

[pkix] [Technical Errata Reported] RFC3280 (9097) rfc-editor
[pkix] Re: [Technical Errata Reported] RFC3280 (9… Denis
[pkix] Re: [Technical Errata Reported] RFC3280 (9… Russ Housley
[pkix] Re: [Technical Errata Reported] RFC3280 (9… Peter Gutmann