6

We are running an enterprise CA on Windows 2008R2. I just did an update to windows 7 on my workstation. Now every time I connect to a remote server using rdp I get a warning stating that the servername is wrong. This is because I use just the hostname for connecting and the cert is created using the fqdn.

The certificates on the servers have been created using autoenrollment with a template based on the computer template.

Is there a way to automatically include the hostname as a subject alternate name (san) and still use autoenrollment? I would like the autoenrolled certificates to have server and server.domain.local as a valid name.

3

You would need to create a new Computer certificate template with the option Subject Name: Supply in the request selected. You will need to provide both the subject name and alternate subject name within the request.

Unfortunately, there is no way to autoenroll with this option, as Windows Certificate Services only allows the use of DNS name or SPN for the alternate.

As an aside, doing something like this would not be considered a security best practice, as an attacker can perform man-in-the-middle attacks with a forged certificate.

3
  • Ist there no way to automate the striping of the domain part from the fqdn? Using abitray names is not good. But using a short host name automatically derived from the fqdn should not be a too big security risk.
    – Jonathan
    Feb 20 '12 at 13:16
  • The entire FQDN makes up the unique identity of the computer; it is not possible for a client to just use part of the name. The only way to work around this is to manually supply the alternate name as part of the request, which must then be manually approved. This is by design to keep people from unknowingly creating unsafe certificates.
    – newmanth
    Feb 20 '12 at 21:06
  • It's possible to give certain (trusted) users the perimission to auto-enroll in the Security tab of the certificate template.
    – fjch1997
    Apr 12 '20 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.