Subject Alternative Names in Microsoft PKI Certificates

I use this little tip often enough, with the split DNS namespace we operate at my current company, that I thought I would post it for the benefit of the search engines.

To add a subject alternative name (SAN) to a certificate request using the PKI web interface or certreq.exe, add the additional DNS names in the attributes section of the request like so:

san:dns=hostname&dns=hostname2

You can add as many as you need. In the case of a Exchange 2010 CAS array, one certificate may carry nearly 10 SAN’s. Don’t forget to have the primary name of the certificate listed as the CN (subject name).

For deeper reference, see MS KB 931351 on how to add a SAN to an LDAPS certificate.