From: jsp(_at_)jgvandyke(_dot_)com (John Pawling)
Jim,
In your reply to my message you said: "Specifically there is nothing that
prevents a CA from issing a new certificate with the same serial number and
issuer name, but different extensions." I respectfully disagree with this
statement, because X.509, verse 3.3.24, defines serial number as follows:
"certificate serial number: An integer value, unique within the issuing CA,
which is unambiguously associated with a certificate issued by that CA."
Perhaps "nothing" is too strong a word, but when the issue is
cryptographic binding of a certificate chain into the signed data,
the fact is that a rogue CA could do something against the rules.