upros / brski-cloud Goto Github PK

from #2:

There does not appear to be a way for CA to send a CSR-Attributes instructing the client to not include a specific field.
Looking at serialNumber which is:
X520SerialNumber ::= PrintableString (SIZE (1..ub-serial-number))
I assume that a X509 parsing stack would complain / not allow a CSR-Attributes response with a NULL value serialNumber.

However, what is stated "the registrar may deem the manufacturer serial number in an IDevID as personally identifiable information, and may want to specify a new random opaque identifier that the pledge should use in its CSR" should be fine. The CA sends a random string as the serialNumber value.