diff --git a/cmd/output_x509certs.go b/cmd/output_x509certs.go
index 1af22fb..ae392c0 100644
--- a/cmd/output_x509certs.go
+++ b/cmd/output_x509certs.go
@@ -177,13 +177,13 @@ func emitOpenSsl(thisX509CertsWithRevocations []tX509CertificateProvisionerRevoc
 			revokedAt = ""
 		}
 
-		fmt.Printf("%s\t%s\t%s\t%039X\t%s\t%s\n",
+		fmt.Printf("%s\t%s\t%s\t%040X\t%s\t%s\n",
 			x509CertWithRevocation.Validity[0:1],
 			regexp.MustCompile(`[-T:]+`).
 				ReplaceAllString(x509CertWithRevocation.X509Certificate.NotAfter.UTC().
 					Format(time.RFC3339), "")[2:], // Construct NotAfter string in compliance with specification.
 			revokedAt,
-			x509CertWithRevocation.X509Certificate.SerialNumber, // len(HEX)=39
+			x509CertWithRevocation.X509Certificate.SerialNumber, // len(HEX(20bytes))=40chars [FF/byte]
 			"unknown", // As per specification.
 			x509CertWithRevocation.X509Certificate.Subject)
 	}