On a technical level, the text file database used by OpenSSL doesn't allow concurrent access, which may place your database at risk.
When you use any software to sign the certificate you are simply applying a function to the certificate signing request. The resulting output is a certificate. Regardless of which piece of software you use to do this, the output will be the same format - an X509 certificate.
Running a Certification Authority requires you to be able to convince relying parties that the certificates you sign are trustworthy. Specifically, when you sign the certificate you attest that to the best of your knowledge the private key is held by the entity named in the certificate, and no other entity. Relying parties should therefore be able to trust that the entity named is who/what they claim to be and no other.
In order to operate a CA and gain the trust of your relying parties you need to do much more than sign the certificate. For example, you will need to:
- Store the transaction in a database
- Ensure that the requestor holds the private key paired to the public key in the certificate request
- Ensure that only you have access to the private signing key used to sign the request
- Ensure that any authorised persons operate your CA
- Record all transactions so that they are auditable
- Define processes for requesting, revoking, renewing certificates etc.
- Much, much more here - have a read of RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework for an idea of what's required
The majority of effort spent on designing and implementing a CA is concerned with the policies and procedures required to ensure trust is maintained. The majority of effort spent on CA operations is concerned with ensuring that the policies and the procedures are rigorously followed.
Unfortunately, while OpenSSL will quite happily create the certificate for you, it fails at all the other points - for example, there is no access control, nor does it store transactions in an auditable log etc. Meanwhile, software specifically written for the task considers the multitude of additional requirements needed to operate a trustworthy CA.
To sumarise - if you're playing, feel free to use OpenSSL; if you need trust, use something better.