Windows: How to generate a SAN certificate via Web enrollment

In environments where you have a Microsoft PKI Infrastructure (AD CA) setup, you can create new certificates via web enrolment:


This is straight forward for single-name certificates. If you wish to have multiple names for a certificate (Subject Alternative Names = SAN), you need a certain syntax in the "Atrributes" field of the web page:

You can add as many names as you want, separated by "&".

Important: With the latest version of Chrome and other browsers,  SANs are mandatory. This means you have to put the subject name + the SAN. Always put the name you have for the subject name also in the SAN.

Leave a Reply

Your email address will not be published. Required fields are marked *