I'm trying to issue a new certificate using the additional attribues field within the Windows CertSrv Web-Enrollment Client.
I added the CSR, picked the template and entered this into the attributes field:
The request is successful but when I check the signed certificate no "Alternative Names" attribute is added to it. Am I missing something? Maybe a issue with the Template? (used a default Win 2003 level webserver template copy with some custom settings).
/edit Also I've tried to use
certreq -submit -attrib "CertificateTemplate:MYTEMPLATE" <Cert Request.req> -attrib "SAN:dns=HOSTNAME&dns=HOSTNAME2&ipaddress=IPADDRESS"
resulting in the same problem: cert gets generated, but without any SAN attribute.
/edit2 also I've set the CA to issue SAN certificates using
certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
and restarting the CA service. Still: no SANs.
Please note: using req. files and OpenSSL to generate the CSR i'm able to generate certifcates using the CA which have some SANs included. However this option is not valid in my current situation since I'm getting the CSR from an application and i'm not able to manually generate one for the application.
/edit3 I tried using the default webserver certificate WITHOUT any changes and suddenly it worked. So now the question is: what are the template requirements to enable SAN?