I'm trying to issue a new certificate using the additional attribues field within the Windows CertSrv Web-Enrollment Client.

I added the CSR, picked the template and entered this into the attributes field:


The request is successful but when I check the signed certificate no "Alternative Names" attribute is added to it. Am I missing something? Maybe a issue with the Template? (used a default Win 2003 level webserver template copy with some custom settings).

/edit Also I've tried to use

certreq -submit -attrib "CertificateTemplate:MYTEMPLATE" <Cert Request.req> -attrib "SAN:dns=HOSTNAME&dns=HOSTNAME2&ipaddress=IPADDRESS"

resulting in the same problem: cert gets generated, but without any SAN attribute.

/edit2 also I've set the CA to issue SAN certificates using

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2

and restarting the CA service. Still: no SANs.

Please note: using req. files and OpenSSL to generate the CSR i'm able to generate certifcates using the CA which have some SANs included. However this option is not valid in my current situation since I'm getting the CSR from an application and i'm not able to manually generate one for the application.

/edit3 I tried using the default webserver certificate WITHOUT any changes and suddenly it worked. So now the question is: what are the template requirements to enable SAN?


I know this is old, but I've just figured it out myself and thought it might help someone else. I too have been unable to get CA to add the SAN via either the web page or the certreq ... -attrib "SAN:DNS=<FQDN>[&DNS=<FQND2>...]..." format. The SAN attribute was ignored, even though the certificate was issued.

However, I found that it works with this format: certreq -attrib "CertificateTemplate:WebServer\nSAN:DNS=<Name1>[&DNS=<name2>...][&IPAddress=<IP1>...]" <csr filename> <cer filename>

For example, if you have a certificate request file called HP_VC.csr and you want the subject alternative names to be vc1, vc2, vc1.domain.com, vc2.domain.com,, and the command would be:

certreq -attrib "CertificateTemplate:WebServer\nSAN:DNS=vc1&DNS=vc2&DNS=vc1.domain.com&DNS=vc2.domain.com&IPAddress=" HP_VC.csr HP_VC.cer

The certificate in HP_VC.cer will contain the SAN attribute.

I'm using this for HP Virtual Connect (VC) modules, Onboard Administrators (OA) and iLOs. It should work for any generic situation that needs a certificate with a SAN.

  • I can't tell you if this would work for me since as I said it just suddenly worked. However a interesting fact I found out however is that the console command NEEDS a template. But don't worry: if the request contains any specific informations the template Settings will be overwritten by the request file. The resulting certificate will state the request informations, not the template informations. – masi Jul 30 '13 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.