RFC 5280 §4.1.2.2 requires serial numbers to be positive and unique per CA and limits them to 20 octets. The Baseline Requirements add that public TLS serial numbers must be non-sequential, less than 2¹⁵⁹ and contain at least 64 bits of CSPRNG output. The randomness makes chosen-prefix collision attacks against the certificate signature impractical, a lesson from the 2008 MD5 rogue-CA attack.
In 2019 several CAs discovered that their software produced only 63 random bits (the top bit was forced to zero to keep the integer positive) and had to revoke and replace millions of certificates. A precertificate and its final certificate share one serial number.
Serial numbers appear in hex in most tools (openssl x509 -serial), with or without colons and leading zeros, which is a common reason why serials copied between systems seem not to match.