Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are running an enterprise CA on Windows 2008R2. I just did an update to windows 7 on my workstation. Now every time I connect to a remote server using rdp I get a warning stating that the servername is wrong. This is because I use just the hostname for connecting and the cert is created using the fqdn.

The certificates on the servers have been created using autoenrollment with a template based on the computer template.

Is there a way to automatically include the hostname as a subject alternate name (san) and still use autoenrollment? I would like the autoenrolled certificates to have server and server.domain.local as a valid name.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You would need to create a new Computer certificate template with the option Subject Name: Supply in the request selected. You will need to provide both the subject name and alternate subject name within the request.

Unfortunately, there is no way to autoenroll with this option, as Windows Certificate Services only allows the use of DNS name or SPN for the alternate.

As an aside, doing something like this would not be considered a security best practice, as an attacker can perform man-in-the-middle attacks with a forged certificate.

share|improve this answer
    
Ist there no way to automate the striping of the domain part from the fqdn? Using abitray names is not good. But using a short host name automatically derived from the fqdn should not be a too big security risk. –  Jonathan Feb 20 '12 at 13:16
    
The entire FQDN makes up the unique identity of the computer; it is not possible for a client to just use part of the name. The only way to work around this is to manually supply the alternate name as part of the request, which must then be manually approved. This is by design to keep people from unknowingly creating unsafe certificates. –  newmanth Feb 20 '12 at 21:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.