diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 5062a19..2c896ee 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -2449,6 +2449,13 @@ Certificate created at:
 # Check serial in db
 check_serial_unique() {
 	[ "$1" ] || user_error "Serial number required!"
+	case "$1" in
+	(*[!1234567890abcdef]*)
+		user_error "Invalid serial number: '$1'"
+	;;
+	*)
+		: # ok
+	esac
 
 	[ "$2" = batch ] && internal_batch=1