[pkix] [Technical Errata Reported] RFC3280 (9097)
rfc-editor@rfc-editor.org Mon, 10 August 2026 16:42 UTC
Return-Path: <rfc-editor@rfc-editor.org>
X-Original-To: pkix@ietf.org
Delivered-To: pkix@mail2.ietf.org
Received: from errata-celery-848864fbc6-v9j4g (gaia.k8s.ietf.org [4.156.85.76]) by mail2.ietf.org (Postfix) with ESMTP id AE65C12741F58; Mon, 10 Aug 2026 09:42:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1786380130; bh=mdNMBPYxrdvD26olheHqK4jncGyiMR+m+ArahPN7vrg=; h=Subject:From:To:Cc:Date; b=ymkwGG2tcWhMOqomVqT8G4/O8glYaUwJxMX3WATa/O7RJnnXvdBetSpY0iovyLK5p pZr+YsJwJhUxVcR94JMUebGJrb0iy6WX3sZAODwBtjWCt25yEHy7cmK3jQ/q61qUCA WmP7WLuOxMncC90VTiYrjUUvGU9hQIW+NJWt2PTE=
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: rfc-editor@rfc-editor.org
To: tim.polk@nist.gov, debcooley1@gmail.com, housley@vigilsec.com, dsolo@alum.mit.edu, stndrds-inacio@andrew.cmu.edu, wford@verisign.com
Date: Mon, 10 Aug 2026 16:42:10 -0000
message-id: <178638013060.15.1586891668281190866@rfc-editor.org>
Message-ID-Hash: FAOHECIRIB57OM7VN4VTBJTTGOGF7Y4D
X-Message-ID-Hash: FAOHECIRIB57OM7VN4VTBJTTGOGF7Y4D
X-MailFrom: rfc-editor@rfc-editor.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-pkix.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: rfc-editor@rfc-editor.org, 1174804262@qq.com, pkix@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [pkix] [Technical Errata Reported] RFC3280 (9097)
List-Id: PKIX Working Group <pkix.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/pkix/jtx-My_IpNLEUx5aeS7JW_NHoYw>
List-Archive: <https://mailarchive.ietf.org/arch/browse/pkix>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Owner: <mailto:pkix-owner@ietf.org>
List-Post: <mailto:pkix@ietf.org>
List-Subscribe: <mailto:pkix-join@ietf.org>
List-Unsubscribe: <mailto:pkix-leave@ietf.org>
The following errata report has been submitted for RFC3280, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile" -------------------------------------- You may review the report below and at: https://errata.rfc-editor.org/eid9097/ -------------------------------------- Type: Technical Reported by: Peng Yuan <1174804262@qq.com> Section 4.1.2.2 says: Original Text ------------- The serial number MUST be a positive integer assigned by the CA to each certificate. It MUST be unique for each certificate issued by a given CA (i.e., the issuer name and serial number identify a unique certificate). CAs MUST force the serialNumber to be a non-negative integer. Corrected Text -------------- The serial number MUST be a positive integer assigned by the CA to each certificate. It MUST be unique for each certificate issued by a given CA (i.e., the issuer name and serial number identify a unique certificate). CAs MUST force the serialNumber to be positive integer. Notes ----- r/non-negative/positive The text contains inconsistent requirements for the certificate serialNumber. The first sentence requires the serial number to be a positive integer, which excludes zero. However, the last sentence requires CAs to force the serialNumber to be a non-negative integer, which permits zero. These two requirements are contradictory and may cause ambiguity for certificate issuers regarding whether a serial number of zero is permitted. The last sentence should use "positive integer" instead of "non-negative integer" to maintain consistency within this section. Instructions: ------------- This erratum is currently posted as "Reported". Please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party will log in to change the status and edit the report, if necessary. -------------------------------------- RFC3280 (draft-ietf-pkix-new-part1) -------------------------------------- Title : Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile Publication Date : May 2002 Author(s) : R. Housley, W. Polk, W. Ford, D. Solo Category : Proposed Standard Source : pkix (sec) Stream : IETF Verifying Party : IESG