Решено: OpenVPN 2.2.0 (failed to update database TXT_DB error number 2)

[leksstav]

При попытке поднять OpenVPN, на последнем шаге создания сертификата клиента выпадает такая вот ошибка

failed to update database
TXT_DB error number 2

Вот весь процесс создания сервера.

Код: Выделить всё

$this_var = suseguru:/etc/openvpn/easy-rsa/1.0 # source ./vars
suseguru:/etc/openvpn/easy-rsa/1.0 # ./clean-all
suseguru:/etc/openvpn/easy-rsa/1.0 # ./build-ca
Generating a 1024 bit RSA private key
.........++++++
........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [RU]:
State or Province Name (full name) [NA]:
Locality Name (eg, city) [Stavropol]:
Organization Name (eg, company) [trust]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:suseguru
Email Address [root@localhost]:
suseguru:/etc/openvpn/easy-rsa/1.0 # ./build-key-server trust
Generating a 1024 bit RSA private key
.............++++++
...........++++++
writing new private key to 'trust.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [RU]:
State or Province Name (full name) [NA]:
Locality Name (eg, city) [Stavropol]:
Organization Name (eg, company) [trust]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:suseguru
Email Address [root@localhost]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/1.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'RU'
stateOrProvinceName   :PRINTABLE:'NA'
localityName          :PRINTABLE:'Stavropol'
organizationName      :PRINTABLE:'trust'
commonName            :PRINTABLE:'suseguru'
emailAddress          :IA5STRING:'root@localhost'
Certificate is to be certified until Jun 10 14:29:13 2021 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
suseguru:/etc/openvpn/easy-rsa/1.0 # ./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
................................................................................
.......+.........+..................................................+...........
.
............................................+...................................
.
......+.........................................................................
.
............+..............+.....................................+..............
.
..+..............................+..........+............++*++*++*
suseguru:/etc/openvpn/easy-rsa/1.0 # ./build-key adm
Generating a 1024 bit RSA private key
.....................++++++
..............................++++++
writing new private key to 'adm.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [RU]:
State or Province Name (full name) [NA]:
Locality Name (eg, city) [Stavropol]:
Organization Name (eg, company) [trust]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:suseguru
Email Address [root@localhost]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/1.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'RU'
stateOrProvinceName   :PRINTABLE:'NA'
localityName          :PRINTABLE:'Stavropol'
organizationName      :PRINTABLE:'trust'
commonName            :PRINTABLE:'suseguru'
emailAddress          :IA5STRING:'root@localhost'
Certificate is to be certified until Jun 10 14:30:24 2021 GMT (3650 days)
Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2

Файл adm.crt создался, но он пустой

[leksstav]

Ларчик, как всегда просто открылся.

Заходим сюда
http://www.mad-hacking.net/documentation/l...signing-csr.xml

И делаем как здесь написано

Allowing non-unique subjects

By default the openssl database configuration disallows duplicate subject entries. This is to ensure that no certificates are issued more than once with the same Subject as this could lead to confusion if the wrong certificate is used. Unfortunately this also prevents the issuing of a new certificate before the existing certificate has expired which is often required so that a seam-less transition can be effected between one certificate and the other.

When an attempt is made to certify a CSR which would result in a duplicate entry being written to the database the following error will be displayed.

failed to update database

TXT_DB error number 2

If you wish to be able to insert duplicate subject keys into the database then the change shown below will allow this.
/etc/certauth/hacking/database/index.txt.attr

unique_subject = yes
unique_subject = no

В файле index.txt.attr

Строчку
unique_subject = yes
меняем на unique_subject = no