Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not sure why I see a negative value in the serial number when I install the client's certificate.

If anyone has any leads or information on this, that would help me greatly.

Serial Number: (Negative)5b:d8:9b:b6:d9

On their system it shows up as a positive value and the value I get is completely different from what they have.

What they see as the first values

Serial Number: a4 27 64 49 26

If you need any more info I'll gladly provide it.

One more question, does the serial number cause problems with trusting each other? At the moment they have problems connecting to my server. I've been trying to narrow down whether it's this serial # issue or they have issues importing my certificates correctly on Windows Thanks for the help!

share|improve this question

Most likely either the cert is badly encoded or the parsing software is 'surprised' at the value. Try viewing the certificate using another tool and examine the serial #.

A reasonable piece of software will refuse to trust a malformed certificate so IFF that is the case it would make sense.

If you share the cert I'll take a look.

Updated: Looks like the cert is perfectly valid under the older RFC but not the current one. Most likely this is due to an outdated Cert Gen function in the client (possibly as R Zeal links to). I suggest you either have them patch/upgrade and regenerate their certificate or otherwise just take their certificate and resign it with your own trusted key (or a trusted third party key) and use that certificate instead.

share|improve this answer
Here is one of the certs that I have troubles with – R Zeal Feb 24 '14 at 15:50
Looks like that certificate is valid under the older specs but not under the newer ones though it's just a bit over a year old. The best thing to do is generate a new key-pair, new certificate signing request, get the new cert signed (or self signed) and move on. In practice this certificate is valid under older specs and so most software will accept it. AFAIK there is no risk with the serial number being negative and most likely it was just generated by out-dated software (Windows). – Ram Feb 24 '14 at 20:19
Thanks for all the info! This is the only customer I have problems connecting with. When they try to query our webservice with SSL enabled they receive errors saying "Could not create SSL/TLS Secure channel" I'm fairly confident that either their cert is not in standards now, or they haven't installed the certs I handed them correctly. If you have thoughts on that as well, that'll be great! – R Zeal Feb 24 '14 at 23:11
I think this is the kicker for why it's a negative serial # – R Zeal Feb 24 '14 at 23:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.