cert serial numbers need to be unique for a given CA