Is the Attributes field in AD CS Web Enrollment now obsolete?
I have implemented a Windows 2008 R2 two tier PKI infrastructure at my organization for some time now. We are just now rolling it out to our general populace. As such, I am tasked with coming up with an instructional presentation for less knowledgeable users. I have found that I cannot use the Attributes field on the Web Enrollment page for requesting SAN certificates.
I read the documentation from Microsoft located at: http://technet.microsoft.com/en-us/library/ff625722(v=ws.10).aspx#BKMK_MakeSanExt .
I can see that in order to request a SAN cert via certreq and .inf file, I must use the [Extensions] section rather than the [RequestAttributes] section. This works when using and INF file. When using the Attributes field in Web Enrollment, my certificate can be issued but the SAN is not present in the resulting certificate. I used the makeSanExtension.vbs script as mentioned in the above site and create the ANSI1 formatted extension then copied it into the Attributes field in Web Enrollment and viewed the Binary certificate request in ADCS and the SAN is not even listed.
So, is there a way to request a SAN via that field? Are there other attributes that may be requested via this field?
Below is what I read from the site mentioned above:
[Extensions]
; If your client operating system is Windows Server 2008, Windows Server 2008 R2, Windows Vista, or Windows 7
; SANs can be included in the Extensions section by using the following text format. Note 2.5.29.17 is the OID for a SAN extension.
2.5.29.17 = "{text}"
_continue_ = "dns=www01.fabrikam.com&"
_continue_ = "dn=CN=www01,OU=Web Servers,DC=fabrikam,DC=com&"
_continue_ = "url=http://www.fabrikam.com&"
_continue_ = "ipaddress=172.31.10.134&"
_continue_ = "email=hazem@fabrikam.com&"
_continue_ = "upn=hazem@fabrikam.com&"
_continue_ = "guid=f7c3ac41-b8ce-4fb4-aa58-3d1dc0e36b39&"
; If your client operating system is Windows Server 2003, Windows Server 2003 R2, or Windows XP
; SANs can be included in the Extensions section only by adding Base64-encoded text containing the alternative names in ASN.1 format.
; Use the provided script MakeSanExt.vbs to generate a SAN extension in this format.
2.5.29.17=MCaCEnd3dzAxLmZhYnJpa2FtLmNvbYIQd3d3LmZhYnJpa2FtLmNvbQ==
[RequestAttributes]
; If your client operating system is Windows Server 2003, Windows Server 2003 R2, or Windows XP
; and you are using a standalone CA, SANs can be included in the RequestAttributes
; section by using the following text format.
SAN="dns=www01.fabrikam.com&dns=www.fabrikam.com&ipaddress=172.31.10.130"
Thanks for the response.
Brian Britt