Automatically create Subject Alternate Name (SAN) Certificates

Question

We are running an enterprise CA on Windows 2008R2. I just did an update to windows 7 on my workstation. Now every time I connect to a remote server using rdp I get a warning stating that the servername is wrong. This is because I use just the hostname for connecting and the cert is created using the fqdn.

The certificates on the servers have been created using autoenrollment with a template based on the computer template.

Is there a way to automatically include the hostname as a subject alternate name (san) and still use autoenrollment? I would like the autoenrolled certificates to have server and server.domain.local as a valid name.

Solution

You would need to create a new Computer certificate template with the option Subject Name: Supply in the request selected. You will need to provide both the subject name and alternate subject name within the request.

Unfortunately, there is no way to autoenroll with this option, as Windows Certificate Services only allows the use of DNS name or SPN for the alternate.

As an aside, doing something like this would not be considered a security best practice, as an attacker can perform man-in-the-middle attacks with a forged certificate.

Comments

[Ashmeet Singh]

The entire FQDN makes up the unique identity of the computer; it is not possible for a client to just use part of the name. The only way to work around this is to manually supply the alternate name as part of the request, which must then be manually approved. This is by design to keep people from unknowingly creating unsafe certificates.

[fjch1997]

It's possible to give certain (trusted) users the perimission to auto-enroll in the Security tab of the certificate template.

[Auditor]

Thanks to this post that cleared my question as I lost my hair while looking for a Microsoft public document which I haven't found. This confirmed my doubts. Thanks