diff --git a/lib/db_x509.cpp b/lib/db_x509.cpp
index 3160c450..3e6c4b43 100644
--- a/lib/db_x509.cpp
+++ b/lib/db_x509.cpp
@@ -313,13 +313,17 @@ void db_x509::writeIndex(const QString &fname, bool hierarchy)
 	}
 }
 
-#define SERIAL_LEN 8
 static a1int randomSerial()
 {
-	unsigned char buf[SERIAL_LEN];
-	RAND_bytes(buf, SERIAL_LEN);
+	unsigned char buf[SHA512_DIGEST_LENGTH];
+	unsigned char md[SHA512_DIGEST_LENGTH];
+
+	Entropy::seed_rng();
+
+	RAND_bytes(buf, SHA512_DIGEST_LENGTH);
+	SHA512(buf, SHA512_DIGEST_LENGTH, md);
 	a1int serial;
-	serial.setRaw(buf, SERIAL_LEN);
+	serial.setRaw(md, (int)Settings["serial_len"] / 8);
 	return serial;
 }
 
@@ -333,8 +337,12 @@ a1int db_x509::getUniqueSerial(pki_x509 *signer)
 		signer_serial = signer->getSerial();
 		revList = signer->getRevList();
 	}
-	while (true) {
+	for (int i=0; ; i++) {
+		if (i > 100)
+			throw errorEx(tr("Failed to retrieve unique random serial"));
 		serial = randomSerial();
+		if (serial == a1int(0L))
+			continue;
 		if (!signer)
 			break;
 		if (signer_serial == serial)
diff --git a/lib/settings.cpp b/lib/settings.cpp
index 699ae14c..d8122088 100644
--- a/lib/settings.cpp
+++ b/lib/settings.cpp
@@ -33,6 +33,7 @@ settings::settings()
 	defaul["default_hash"] = hashBox::getDefault();
 	defaul["ical_expiry"] = "1W";
 	defaul["cert_expiry"] = "80%";
+	defaul["serial_len"] = "8";
 
 	clear();
 }
diff --git a/lib/settings.h b/lib/settings.h
index 8e6cd2cb..199b0be8 100644
--- a/lib/settings.h
+++ b/lib/settings.h
@@ -35,12 +35,12 @@ class svalue
 	}
 	int operator = (int val)
 	{
-		set(QString(val));
+		set(QString("%1").arg(val));
 		return val;
 	}
 	unsigned operator = (unsigned val)
 	{
-		set(QString(val));
+		set(QString("%1").arg(val));
 		return val;
 	}
 	bool operator = (bool val)
diff --git a/ui/Options.ui b/ui/Options.ui
index 39da6b3c..a08e91b2 100644
--- a/ui/Options.ui
+++ b/ui/Options.ui
@@ -149,6 +149,36 @@ Especially EC and DSA are only defined with SHA1 in the PKCS#11 specification.</
          </item>
         </layout>
        </item>
+       <item>
+        <layout class="QHBoxLayout" name="horizontalLayout_4">
+         <item>
+          <widget class="QLabel" name="label_5">
+           <property name="text">
+            <string>Serial number length</string>
+           </property>
+          </widget>
+         </item>
+         <item>
+          <widget class="QSpinBox" name="serial_len">
+           <property name="suffix">
+            <string> bit</string>
+           </property>
+           <property name="minimum">
+            <number>8</number>
+           </property>
+           <property name="maximum">
+            <number>256</number>
+           </property>
+           <property name="singleStep">
+            <number>8</number>
+           </property>
+           <property name="value">
+            <number>64</number>
+           </property>
+          </widget>
+         </item>
+        </layout>
+       </item>
        <item>
         <spacer name="verticalSpacer_2">
          <property name="orientation">
diff --git a/widgets/Options.cpp b/widgets/Options.cpp
index 0ec0bdbf..a289bbd3 100644
--- a/widgets/Options.cpp
+++ b/widgets/Options.cpp
@@ -65,6 +65,8 @@ Options::Options(MainWindow *parent)
 	cert_expiry_unit->addItemsData(units, x.right(1));
 	x.chop(1);
 	cert_expiry_num->setText(x);
+
+	serial_len->setValue(Settings["serial_len"]);
 }
 
 Options::~Options()
@@ -147,6 +149,7 @@ int Options::exec()
 				cert_expiry_unit->currentItemData().toString();
 	Settings["ical_expiry"] = ical_expiry_num->text() +
 				ical_expiry_unit->currentItemData().toString();
+	Settings["serial_len"] = serial_len->value();
 
 	return TransCommit() ? QDialog::Accepted : QDialog::Rejected;
 }