same problem, but i am not using -sub
i make and sign two certs successfully, and die on the third
% openssl req -new -nodes -newkey rsa:1024 -sha1 -keyform PEM -keyout
privkey.pem -outform PEM -out newreq.pem
Generating a 1024 bit RSA private key
...........................++++++
..++++++
writing new private key to 'privkey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:Washington
Locality Name (eg, city) []:Seattle
Organization Name (eg, company) [Internet Widgits Pty Ltd]:RGnet, LLC
Organizational Unit Name (eg, section) []:PSGnet
Common Name (eg, YOUR name) []:Randy Bush
Email Address []:[EMAIL PROTECTED]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <hidden>
An optional company name []:
% CA.pl -sign
Using configuration from /usr/home/randy/.openssl.cnf
Enter pass phrase for ./private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 3 (0x3)
Validity
Not Before: Jun 22 13:35:33 2003 GMT
Not After : Jun 21 13:35:33 2004 GMT
Subject:
countryName = US
stateOrProvinceName = Washington
localityName = Seattle
organizationName = RGnet, LLC
organizationalUnitName = PSGnet
commonName = Randy Bush
emailAddress = [EMAIL PROTECTED]
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
C0:52:5B:EA:3B:DB:29:DD:F9:E8:C4:2B:59:04:34:5C:90:CC:85:EF
X509v3 Authority Key Identifier:
keyid:54:9A:46:AD:16:8E:E8:01:49:79:48:9A:94:09:F0:02:D0:BA:64:80
DirName:/C=US/ST=Washingron/L=Bainbridge
Island/O=RGnet/PSGnet/OU=Engineering/CN=RGnet Root
CA/[EMAIL PROTECTED]
serial:00
Certificate is to be certified until Jun 21 13:35:33 2004 GMT (365 days)
Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2
Signed certificate is in newcert.pem
% cat serial
03
% ls -l newcerts/
total 8
-rw------- 1 randy staff 3737 Jun 22 06:03 01.pem
-rw------- 1 randy staff 3715 Jun 22 06:12 02.pem
randy <[EMAIL PROTECTED]>
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
