[saag] Question about PKI - certificate serial number

[Hosnieh Rafiee <[e-mail]>]

Hello,


In RFC 5280, I read that the issuer of the certificate, assigned a
unique number to each certificate and call it a serial number. I assume
that this serial number is sent by the CA to client whenever the client
asks for the certificate of this intermediate CA. That means the
attacker might be able to eavesdrop this serial number.  is this
assumption true? that means the attacker might be able also to spoof and
use the same serial number for its fake Certificate.

I guess I am confused in some part of processes .... what if  the client
only have the list of trusted anchors received from root or issuer CA
that includes certificate serial number, issuer and some other
information as mentioned in the above RFC, how would be the serial
numbers protected against spoofing attack? specially if the client
verification method is only based on trusting this list and not go
through asking the issuer to download the intermediate CA certificate
from the repository?

The second question is that, when root CA is not always online, that
means the CRL list is valid for a certain period of time. if during this
time a certificate is compromised, the root needs to send a new CRL to
clients. In this case, if the attacker perform  replay attack with the
old list, is there any in use method to avoid such attack?

I would appreciate if someone can clarify these cases or point me to the
right RFC.

Thanks,

Best,

Hosnieh