I have not checked your patch, but notice that some OpenSSL routines
were not able to handle serial numbers larger that 32 bits (that are
legal and the Microsoft Certificate Server customarily creates) unless
they are not represented as integers but as some non
standard-compliant series of decimal or even hexadecimal thingies
separated by colons. I painfully wrote code what would produce an
integer of unrestricted length (that OpenLDAP's own integerMatch
supported). And I could not do it with standard OpenSSL routines.