Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to issue a new certificate using the additional attribues field within the Windows CertSrv Web-Enrollment Client.

I added the CSR, picked the template and entered this into the attributes field:


The request is successful but when I check the signed certificate no "Alternative Names" attribute is added to it. Am I missing something? Maybe a issue with the Template? (used a default Win 2003 level webserver template copy with some custom settings).

/edit Also I've tried to use

certreq -submit -attrib "CertificateTemplate:MYTEMPLATE" <Cert Request.req> -attrib "SAN:dns=HOSTNAME&dns=HOSTNAME2&ipaddress=IPADDRESS"

resulting in the same problem: cert gets generated, but without any SAN attribute.

/edit2 also I've set the CA to issue SAN certificates using

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2

and restarting the CA service. Still: no SANs.

Please note: using req. files and OpenSSL to generate the CSR i'm able to generate certifcates using the CA which have some SANs included. However this option is not valid in my current situation since I'm getting the CSR from an application and i'm not able to manually generate one for the application.

/edit3 I tried using the default webserver certificate WITHOUT any changes and suddenly it worked. So now the question is: what are the template requirements to enable SAN?

share|improve this question

I know this is old, but I've just figured it out myself and thought it might help someone else. I too have been unable to get CA to add the SAN via either the web page or the certreq ... -attrib "SAN:DNS=<FQDN>[&DNS=<FQND2>...]..." format. The SAN attribute was ignored, even though the certificate was issued.

However, I found that it works with this format: certreq -attrib "CertificateTemplate:WebServer\nSAN:DNS=<Name1>[&DNS=<name2>...][&IPAddress=<IP1>...]" <csr filename> <cer filename>

For example, if you have a certificate request file called HP_VC.csr and you want the subject alternative names to be vc1, vc2,,,, and the command would be:

certreq -attrib "CertificateTemplate:WebServer\nSAN:DNS=vc1&DNS=vc2&" HP_VC.csr HP_VC.cer

The certificate in HP_VC.cer will contain the SAN attribute.

I'm using this for HP Virtual Connect (VC) modules, Onboard Administrators (OA) and iLOs. It should work for any generic situation that needs a certificate with a SAN.

share|improve this answer
I can't tell you if this would work for me since as I said it just suddenly worked. However a interesting fact I found out however is that the console command NEEDS a template. But don't worry: if the request contains any specific informations the template Settings will be overwritten by the request file. The resulting certificate will state the request informations, not the template informations. – masi Jul 30 '13 at 20:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.