Problem
You’ve completed the process of creating a new keystore with a CSR from the Portecle utility:
http://portecle.sourceforge.net/
Since the Portecle utility does not provide the feature to include SAN entries:
https://www.sslsupportdesk.com/portecle-advanced-keystore-creation-and-manipulation-tool/
This isn’t usually a problem because it is possible to add SAN entries in the Additional Attributes field when submitting the CSR to a Microsoft Certificate Authority server as described here:
How to add a subject alternative name to a secure LDAP certificate
https://support.microsoft.com/en-us/help/931351/how-to-add-a-subject-alternative-name-to-a-secure-ldap-certificate
An example of the format of the string to include is:
san:dns=corpdc1.fabrikam.com&dns=ldap.fabrikam.com
You proceed to submit the request:
… but notice that the generated certificate does not include a SAN entry.
Solution
One of the reasons why performing the above would not generate a certificate that includes a SAN entry is if the issuance policy of the Microsoft CA is not configured to accept the Subject Alternative Name(s) attribute via the CA Web enrollment page. To correct this, execute the following command:
certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
Once the above command is executed, stop and start the certificate authority with:
net stop certsvc
net start certsvc
Proceed to use the CA web enrollment page to generate the certificate with the SAN entry.
---------------------------------------------------------------------------------------------------------------------------
Security Concerns:
Note that as per the following Microsoft article:
https://technet.microsoft.com/en-us/library/ff625722(v=ws.10).aspx
It is not recommended to enable the acceptance of the SAN attribute for the CA Web enrollment page so please review the Security best practices for allowing SANs in certificates section in the article above to be aware of the security concerns.