SOLVED: How To Generate A Multi-Domain CSR On A Windows Server?

Subject Alternative Names (SAN) certificates can save time and money because they allow you to use a single certificate for upto 5 domain names.  They are quite common on servers that run Microsoft Exchange.

Cloud providers of Exchange Online, like Office 365, usually take care of their own certificates and now that Exchange on-prem has become less fashionable with the tech community, it is easy to forget about SAN Certificates, so we here is are the easy, but far from obvious steps you need to follow to create a SAN Certificate Request (aka, SAN CSR).

In the example below we are going to build a SAN cert request for the following domains:

• mail.urtech.ca
• autodiscover.urtech.ca
• urtech.ca
• exchg01.urtech.ca
• www.mail.urtech.ca

How To Create a Multi-Domain SAN Cert Request:

PHASE 1 – How To Get Into the Certificate Repository

1. Click START, type MMC.EXE and click on it
2. File FILE > ADD/REMOVE SNAP-IN…
3. Double click CERTIFICATE SERVICES
4. Click COMPUTER ACCOUNT > NEXT button
5. Leave on LOCAL COMPUTER and select FINISH
6. Click OK on the ADD OR REMOVE SNAP-INS with CERTIFICATES (LOCAL COMPUTER)

PHASE 2 – How To Create the SAN Certificate Request

1. Right click on PERSONAL and select ALL TASKS > ADVANCED OPERATIONS > CREATE A CUSTOM REQUEST
2. Click NEXT on CERTIFICATE ENROLLMENT screen
3. Click CUSTOM REQUEST > PROCEED WITHOUT ENROLLMENT POLICY and then NEXT
4. On the CUSTOM REQUEST screen, change nothing and click NEXT
5. On the CERTIFICATE INFORMATION screen, click the DETAILS expansion and the PROPERTIES button
6. Click the SUBJECT tab:
   1. change the SUBJECT NAME: TYPE to COMMON NAME and enter the main URL
   2. change the ALTERNATIVE NAMES: TYPE to DNS enter the secondary URLs
7. Click the PRIVATE KEY tab
   1. Expand KEY OPTIONS and set the KEY SIZE to 2048
   2. Click on MAKE PRIVATE KEY EXPORTABLE and then the OK button
   3. In the WHERE DO YOU WANT TO SAVE THE OFFLINE REQUEST, click BROWSE or just type a name and click FINISH

PHASE 3 – How To Check Your SAN Certificate Request Before Buying?

Before you buy your cert, you may want to validate that it is what you think it is.  There are several CSR Decoders available but I use (no, they have not paid us for the link and we have no relationship to them):

https://www.sslshopper.com/csr-decoder.html 

Paste the content of your CSR into the large field and submit it (see the screenshot to the right).