Re: Why is the crlNumber an OCTET STRING?

Not only is it not an OCTET STRING, you chose to use RFC 3280 instead of 
RFC 5280. :-(

Having said that, the question is germane. I cannot see how:
    The CRL number is a non-critical CRL extension that conveys a
    monotonically increasing sequence number for a given CRL scope and
    CRL issuer.
and
    Given the requirements above, CRL numbers can be expected to contain
    long integers.  CRL verifiers MUST be able to handle CRLNumber 
values
    up to 20 octets.
can both be true. I think that "long integers" is correct for some value 
of "long", but "20 octets" is just silly. I don't mind saying that CRL 
verifiers must be able to handle silly values, but would prefer to not 
have said that.

--Paul Hoffman