8

At work a lot of our internal servers have SSL certs we've generated ourselves with openssl (through some simple scripts). The generation works fine, but the subsequent handling needs improvements, as a consequence we've lost any non-encrypted copy of the SSL cert for a server. The consequence is just that we'll have to spend some time making a new cert and deploying it, but this leads me to the problem.

When I try to create a new SSL cert for internal.server.company, openssl fails at the end of the process with

failed to update database
TXT_DB error number 2

because there is already a certificate for that host in the database.

If the old cert had expired, I believe openssl ca -updatedb would remove it from the database, but that is not the case.

I can work around it by opening (the relevant) index.txt in an editor, search for internal.server.company and delete the line found - but that seems like a hack. Is there a good way to make openssl accept that I want to make a new cert for name that i thinks already has a cert?

1

1 Answer 1

15

In the same folder as your database (the index.txt file) create a file index.txt.attr and add the following:

unique_subject = no

If you're unsure where your database file is located, check the openssl.cnf file you're using for something like the following:

[ CA_default ]

dir             = ./demoCA              # Where everything is kept
certs           = $dir/certs            # Where the issued certs are kept
crl_dir         = $dir/crl              # Where the issued crl are kept
database        = $dir/index.txt

In the above example, the database is index.txt and resides in ./demoCA. You'll therefore need to place your new index.txt.attr file in ./demoCA.

In case the database filename is only index you need to name the new file index.attr.

2
  • 1
    Or put it in the config file (as per the man page) and openssl automatically writes it to the correct $db.attr for you Feb 24, 2020 at 2:17
  • @dave_thompson_085 and anyone reading that comment, actually you should create the undocumented file as suggested in this answer OR add the config file value (as per the man page) but add a comment to DELETE the $db.attr file when changing this value, and then DELETE the $db.attr file. The undocumented, and automatically created if missing, .attr file overrides the documented config file value (tested under v3.0.2). Dec 4, 2023 at 0:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .