Attribute field in 2008 R2 AD CS Web Enrollment - Obsolete?

Question

Is the Attributes field in AD CS Web Enrollment now obsolete?
I have implemented a Windows 2008 R2 two tier PKI infrastructure at my organization for some time now. We are just now rolling it out to our general populace. As such, I am tasked with coming up with an instructional presentation for less knowledgeable
users. I have found that I cannot use the Attributes field on the Web Enrollment page for requesting SAN certificates.
I read the documentation from Microsoft located at:
http://technet.microsoft.com/en-us/library/ff625722(v=ws.10).aspx#BKMK_MakeSanExt .
I can see that in order to request a SAN cert via certreq and .inf file, I must use the [Extensions] section rather than the [RequestAttributes] section. This works when using and INF file. When using the Attributes field in Web Enrollment, my certificate
can be issued but the SAN is not present in the resulting certificate. I used the makeSanExtension.vbs script as mentioned in the above site and create the ANSI1 formatted extension then copied it into the Attributes field in Web Enrollment
and viewed the Binary certificate request in ADCS and the
SAN is not even listed.  
So, is there a way to request a SAN via that field? Are there other attributes that may be requested via this field?
Below is what I read from the site mentioned above:
[Extensions]
; If your client operating system is Windows Server 2008, Windows Server 2008 R2, Windows Vista, or Windows 7
; SANs can be included in the Extensions section by using the following text format. Note 2.5.29.17 is the OID for a SAN extension.
2.5.29.17 = "{text}"
_continue_ = "dns=www01.fabrikam.com&"
_continue_ = "dn=CN=www01,OU=Web Servers,DC=fabrikam,DC=com&"
_continue_ = "url=http://www.fabrikam.com&"
_continue_ = "ipaddress=172.31.10.134&"
_continue_ = "[email protected]&"
_continue_ = "[email protected]&"
_continue_ = "guid=f7c3ac41-b8ce-4fb4-aa58-3d1dc0e36b39&"
; If your client operating system is Windows Server 2003, Windows Server 2003 R2, or Windows XP
; SANs can be included in the Extensions section only by adding Base64-encoded text containing the alternative names in ASN.1 format.
; Use the provided script MakeSanExt.vbs to generate a SAN extension in this format.
2.5.29.17=MCaCEnd3dzAxLmZhYnJpa2FtLmNvbYIQd3d3LmZhYnJpa2FtLmNvbQ==
[RequestAttributes]
; If your client operating system is Windows Server 2003, Windows Server 2003 R2, or Windows XP
; and you are using a standalone CA, SANs can be included in the RequestAttributes
; section by using the following text format.
SAN="dns=www01.fabrikam.com&dns=www.fabrikam.com&ipaddress=172.31.10.130"
Thanks for the response.
Brian Britt
 

Answer 1

On Mon, 7 Apr 2014 18:50:47 +0000, Brtian wrote:
Is the Attributes field in AD CS Web Enrollment now obsolete?
No.
I have implemented a Windows 2008 R2 two tier PKI infrastructure at my organization for some time now. We are just now rolling it out to our general populace. As such, I am tasked with coming up with an instructional presentation for less knowledgeable
users. I have found that I cannot use the Attributes field on the Web Enrollment page for requesting SAN certificates.
I read the documentation from Microsoft located at:
http://technet.microsoft.com/en-us/library/ff625722(v=ws.10).aspx#BKMK_MakeSanExt .
I can see that in order to request a SAN cert via certreq and .inf file, I must use the [Extensions] section rather than the [RequestAttributes] section. This works when using and INF file. When using the Attributes field in Web Enrollment, my certificate
can be issued but the SAN is not present in the resulting certificate. I used the makeSanExtension.vbs script as mentioned in the above site and create the ANSI1 formatted extension then copied it into the Attributes field in Web Enrollment
and viewed the Binary certificate request in ADCS and the SAN is not even listed.  
So, is there a way to request a SAN via that field? Are there other attributes that may be requested via this field?
You're reading the documentation incorrectly. That script is only required if you're going to use an INF file for the request. If you're going to use the web enrollment pages (which is
not recommended as per the security warnings in the article) you need to enter something like the following in that section:
san:dns=corpdc1.fabrikam.com&dns=ldap.fabrikam.com
This example will register two SANs. Multiple SANs, if required, are separated with an &.
From a security perspective I would strongly suggest that you forget about using the web enrollment and instead document how to use the Certificates MMC console.
Paul Adare - FIM CM MVP
"Space Aliens ate my UNIX compatibility!" -- cm about AIX