I don&#x27;t get the issue with serial numbers. For the browser, it&#x27;s a completely opaque random number - it doesn&#x27;t matter what it is and how it changes.<p>Is the issue here that they&#x27;re talking about CA collisions and need the &quot;authority key identifier&quot; extension to match? This shouldn&#x27;t matter when colliding with service certificates.