CRL serials are base-16, not base-10.

And we never caught it before because we never had more than 10 revoked certs.  After today we have a bunch and so stuff started getting hung up on this.