At work a lot of our internal servers have SSL certs we've generated ourselves with
openssl (through some simple scripts). The generation works fine, but the subsequent handling needs improvements, as a consequence we've lost any non-encrypted copy of the SSL cert for a server. The consequence is just that we'll have to spend some time making a new cert and deploying it, but this leads me to the problem.
When I try to create a new SSL cert for
internal.server.company, openssl fails at the end of the process with
failed to update database TXT_DB error number 2
because there is already a certificate for that host in the database.
If the old cert had expired, I believe
openssl ca -updatedb would remove it from the database, but that is not the case.
I can work around it by opening (the relevant)
index.txt in an editor, search for
internal.server.company and delete the line found - but that seems like a hack. Is there a good way to make openssl accept that I want to make a new cert for name that i thinks already has a cert?