I've been using OpenSSL as an X.509 certificate authority. Because multiple machines will need to create certificates, I've exported the certificate authority folder on a distributed filesystem.
When I stress-test my CA by making hundreds of concurrent certificate signing requests, I occasionally see weird errors such as
unable to rename ./index.txt.attr.new to ./index.txt.attr
reason: No such file or directory
I'm not sure whether this is an OpenSSL bug or an issue with my distributed file system, but using text files to hold all certificate data seems generally bad for concurrent access, so I'd rather switch to a more robust architecture than debug this particular issue.
Ideally, I'd like a certificate authority that stores its state in a proper database rather than text files. It doesn't look like OpenSSL can do that. The documentation for the database parameter at http://www.openssl.org/docs/apps/ca.html#CONFIGURATION_FILE_OPTIONS says
the text database file to use. Mandatory. This file must be present though initially it will be empty.
Could anyone recommend a good open source database-backed X.509 certificate authority for Linux?
I've exported the certificate authority folder on a distributed filesystem
- Uhm, what?? That typically contains the private key, which must be kept private. Don't do that. Anyway, what are the keys for? What OS are all the machines? If this is a *nix network, I would look at one of the puppet modules.