$ openssl ca ... failed to update database TXT_DB error number 2 You may see this when trying to generate a new SSL certificate, but the same DN (the common name, etc.) was used before (and recorded in index.txt). Many people should see this error, because we frequently rotate SSL certificates with new ones for additional security ;) You may then discover the fix is to set 'unique_subject = no' in openssl.cnf, but find that it still doesn't work. This is because when initialising the CA, the setting was duplicated into index.txt.attr to confuse you.