My certificates issued via /certsrv web portal miss custom SAN extensions without any error during submission. Certificates drop SANs on their own. How can I enable the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the CA. CA is on Windows Server infrastructure.

Question

My certificates issued via /certsrv web portal miss custom SAN extensions without any error during submission. Certificates drop SANs on their own. How can I enable the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the CA. CA is on Windows Server infrastructure.

Omo Bento 20

Certificates issued via the legacy /certsrv web portal on the CA infrastructure are automatically dropping custom SAN extensions requested during submission without any manual intervention. Some certificates are missing the Subject Alternative Name completely, while some certificates immediately break SSL validation. Multiple issued certificate properties confirmed in the CA console verify the missing custom attributes. CA server uptime is normal and base certificate template issuance is normal, confirming the issue is not on the template level and requires enabling the EDITF_ATTRIBUTESUBJECTALTNAME2 flag to process custom attributes.

0 comments

1 answer

Your answer

Answer 1

Hello,

what you are seeing is expected behavior when the CA is not configured to honor custom SAN attributes submitted via the legacy /certsrv web enrollment pages. By default, the Certificate Services engine strips SAN extensions unless the CA is explicitly told to process them. The flag you mentioned, EDITF_ATTRIBUTESUBJECTALTNAME2, is the documented Microsoft requirement to allow Subject Alternative Name attributes to be passed through request attributes rather than ignored.

To enable this, you need to adjust the CA configuration at the registry level. On the issuing CA, open regedit and navigate to:

HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CAName>

Locate or create the EditFlags DWORD value. You must set the bitmask to include EDITF_ATTRIBUTESUBJECTALTNAME2. The numeric value for this flag is 0x00040000. If other flags are already set, you add this value to the existing bitmask rather than overwrite it. After making the change, restart the Certificate Services service (net stop certsvc && net start certsvc) for the setting to take effect.

Once enabled, the CA will honor SAN attributes submitted via the web portal or certreq with -attrib "SAN=dns=...". Without this flag, the SAN is silently dropped, which is why you are seeing certificates issued without the requested extensions.

Be aware that this change affects all requests processed by the CA. You should confirm that your certificate templates and issuance policies are aligned with your security requirements, since enabling SAN processing via attributes can allow requesters to specify arbitrary SANs. In many environments, administrators restrict SAN issuance to controlled templates to prevent misuse.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.