Generating duplicate certificates with OpenSSL CA

Question

At work a lot of our internal servers have SSL certs we've generated ourselves with openssl (through some simple scripts). The generation works fine, but the subsequent handling needs improvements, as a consequence we've lost any non-encrypted copy of the SSL cert for a server. The consequence is just that we'll have to spend some time making a new cert and deploying it, but this leads me to the problem.

When I try to create a new SSL cert for internal.server.company, openssl fails at the end of the process with

failed to update database
TXT_DB error number 2

because there is already a certificate for that host in the database.

If the old cert had expired, I believe openssl ca -updatedb would remove it from the database, but that is not the case.

I can work around it by opening (the relevant) index.txt in an editor, search for internal.server.company and delete the line found - but that seems like a hack. Is there a good way to make openssl accept that I want to make a new cert for name that i thinks already has a cert?

Answer 1

In the same folder as your database (the index.txt file) create a file index.txt.attr and add the following:

unique_subject = no

If you're unsure where your database file is located, check the openssl.cnf file you're using for something like the following:

[ CA_default ]

dir             = ./demoCA              # Where everything is kept
certs           = $dir/certs            # Where the issued certs are kept
crl_dir         = $dir/crl              # Where the issued crl are kept
database        = $dir/index.txt

In the above example, the database is index.txt and resides in ./demoCA. You'll therefore need to place your new index.txt.attr file in ./demoCA.

In case the database filename is only index you need to name the new file index.attr.