Quick note from the field on enabling SAN support on Windows 2008 Certificate Server.

From the command line on the certificate server run:

1. certutil –setreg policy\SubjectAltName enabled
2. certutil –setreg policy\SubjectAltName2 enabled
3. Restart the certificate service

References:

Registry entries with Certificate Services (Windows 2003)
http://technet.microsoft.com/en-us/library/cc780742.aspx

SubjectAltName

Registry Path

CertSvc\Configuration\CAName\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\SubjectAltName

Version

Windows Server 2003 and Windows 2000 Server

This setting uses an OID for the SubjAltName extension of an issued certificate. This setting is almost never used.

SubjectAltName2

Registry Path

CertSvc\Configuration\CAName\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\SubjectAltName2

Version

Windows Server 2003 and Windows 2000 Server

This setting makes it possible for a stand-alone CA to place in the SubjAltName extension of an issued certificate the e-mail address of the authenticated user making the certificate request. This setting is rarely used.

Certificate Deployment Planning
http://technet.microsoft.com/en-us/library/cc732809.aspx

• For user certificates, the Subject Alternative Name (SubjectAltName) extension, if used, must contain the user principal name (UPN). By default, the User certificate template is configured with the UPN.
• For computer certificates, the SubjectAltName extension, if used, must contain the computer's fully qualified domain name (FQDN), which is also called the DNS name. By default, the Workstation Authentication certificate template is not configured with this value and must be reconfigured to meet this requirement according to the instructions in Configure the Workstation Authentication Certificate Template.