- draws certificate serial numbers from [1, 2^159 - 1] via crypto/rand, the largest
value that DER-encodes within RFC 5280's 20-octet signed-integer limit
- ensures serials are strictly positive
- returns RNG errors from SerialGenerator.Generate instead of discarding them, and
propagates them through ServerSigner/ClientSigner SignCsr
- adds a test asserting serial positivity and the 20-octet encoding bound
Paul Lorenz
8f69a7fcdc