diff --git a/src/pki/commands/acert.c b/src/pki/commands/acert.c
index 4cbe06c9e..d02d25669 100644
--- a/src/pki/commands/acert.c
+++ b/src/pki/commands/acert.c
@@ -43,7 +43,6 @@ static int acert()
 	chunk_t serial = chunk_empty, encoding = chunk_empty;
 	time_t not_before, not_after, lifetime = 24 * 60 * 60;
 	char *datenb = NULL, *datena = NULL, *dateform = NULL;
-	rng_t *rng;
 	char *arg;
 	bool pss = lib->settings->get_bool(lib->settings, "%s.rsa_pss", FALSE,
 									   lib->ns);
@@ -186,22 +185,10 @@ static int acert()
 	{
 		serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
 	}
-	else
+	else if (!allocate_serial(8, &serial))
 	{
-		rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
-		if (!rng)
-		{
-			error = "no random number generator found";
-			goto end;
-		}
-		if (!rng_allocate_bytes_not_zero(rng, 8, &serial, FALSE))
-		{
-			error = "failed to generate serial number";
-			rng->destroy(rng);
-			goto end;
-		}
-		serial.ptr[0] &= 0x7F;
-		rng->destroy(rng);
+		error = "failed to generate serial number";
+		goto end;
 	}
 
 	if (file)
diff --git a/src/pki/commands/issue.c b/src/pki/commands/issue.c
index f20e2e3c4..6d93067b8 100644
--- a/src/pki/commands/issue.c
+++ b/src/pki/commands/issue.c
@@ -432,23 +432,10 @@ static int issue()
 	{
 		serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
 	}
-	else
+	else if (!allocate_serial(8, &serial))
 	{
-		rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
-
-		if (!rng)
-		{
-			error = "no random number generator found";
-			goto end;
-		}
-		if (!rng_allocate_bytes_not_zero(rng, 8, &serial, FALSE))
-		{
-			error = "failed to generate serial number";
-			rng->destroy(rng);
-			goto end;
-		}
-		serial.ptr[0] &= 0x7F;
-		rng->destroy(rng);
+		error = "failed to generate serial number";
+		goto end;
 	}
 
 	if (pkcs10)
diff --git a/src/pki/commands/self.c b/src/pki/commands/self.c
index cb7567c37..20f8f8be4 100644
--- a/src/pki/commands/self.c
+++ b/src/pki/commands/self.c
@@ -368,23 +368,10 @@ static int self()
 	{
 		serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
 	}
-	else
+	else if (!allocate_serial(8, &serial))
 	{
-		rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
-
-		if (!rng)
-		{
-			error = "no random number generator found";
-			goto end;
-		}
-		if (!rng_allocate_bytes_not_zero(rng, 8, &serial, FALSE))
-		{
-			error = "failed to generate serial number";
-			rng->destroy(rng);
-			goto end;
-		}
-		serial.ptr[0] &= 0x7F;
-		rng->destroy(rng);
+		error = "failed to generate serial number";
+		goto end;
 	}
 	scheme = get_signature_scheme(private, digest, pss);
 	if (!scheme)
diff --git a/src/pki/pki.c b/src/pki/pki.c
index d275f0cf6..f3b9cdf55 100644
--- a/src/pki/pki.c
+++ b/src/pki/pki.c
@@ -340,6 +340,41 @@ traffic_selector_t* parse_ts(char *str)
 	return traffic_selector_create_from_cidr(str, 0, 0, 65535);
 }
 
+/*
+ * Described in header
+ */
+bool allocate_serial(size_t len, chunk_t *serial)
+{
+	rng_t *rng;
+
+	if (!len)
+	{
+		len = 1;
+	}
+	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+	if (!rng)
+	{
+		fprintf(stderr, "no random number generator found\n");
+		return FALSE;
+	}
+	if (!rng_allocate_bytes_not_zero(rng, len, serial, FALSE))
+	{
+		rng->destroy(rng);
+		return FALSE;
+	}
+	/* ensure the serial is positive but doesn't start with 0 */
+	while (!(serial->ptr[0] &= 0x7F))
+	{
+		if (!rng->get_bytes(rng, 1, serial->ptr))
+		{
+			rng->destroy(rng);
+			return FALSE;
+		}
+	}
+	rng->destroy(rng);
+	return TRUE;
+}
+
 /**
  * Callback credential set pki uses
  */
diff --git a/src/pki/pki.h b/src/pki/pki.h
index 3976c33b7..feb683432 100644
--- a/src/pki/pki.h
+++ b/src/pki/pki.h
@@ -79,4 +79,13 @@ signature_params_t *get_signature_scheme(private_key_t *private,
  */
 traffic_selector_t* parse_ts(char *str);
 
+/**
+ * Generate a random serial number for certificates.
+ *
+ * @param len       length of the generated serial number
+ * @param serial    allocated serial number
+ * @return          TRUE if allocation was successful
+ */
+bool allocate_serial(size_t len, chunk_t *serial);
+
 #endif /** PKI_H_ @}*/