The ca man page recommends that the "unique_subject" config parameter should be set to "no", but the default is "yes". It is set to "yes" for "compatibility with older (pre 0.9.8) versions of OpenSSL".

For 1.2.0 we should change the default.

Also see the discussion in #5444.