At work a lot of our internal servers have SSL certs we've generated ourselves with openssl (through some simple scripts). The generation works fine, but the subsequent handling needs improvements, as a consequence we've lost any non-encrypted copy of the SSL cert for a server. The consequence is just that we'll have to spend some time making a new cert and deploying it, but this leads me to the problem.

When I try to create a new SSL cert for internal.server.company, openssl fails at the end of the process with

failed to update database
TXT_DB error number 2

because there is already a certificate for that host in the database.

If the old cert had expired, I believe openssl ca -updatedb would remove it from the database, but that is not the case.

I can work around it by opening (the relevant) index.txt in an editor, search for internal.server.company and delete the line found - but that seems like a hack. Is there a good way to make openssl accept that I want to make a new cert for name that i thinks already has a cert?


In the same folder as your database (the index or index.txt file) create a file index.attr and add the following:

unique_subject = no

If you're unsure where your database file is located, check the openssl.cnf file you're using for something like the following:

[ CA_default ]

dir             = ./demoCA              # Where everything is kept
certs           = $dir/certs            # Where the issued certs are kept
crl_dir         = $dir/crl              # Where the issued crl are kept
database        = $dir/index.txt

In the above example, the database is index.txt and resides in ./demoCA. You'll therefore need to place your new index.attr file in ./demoCA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.