How can I add the base FQDN to an additional SAN field to the LDAP cert on a domain controller?

Question

Recently I've been setting up some older Linux applications to use LDAP against our domain. We strictly use LDAPS in our environment. I'd like to setup the LDAP string with just the name of the root of the domain (ex: domain.local) rather than pointing to a single server in case of DC failure. The Linux boxes often return an error saying the LDAP Cert doesn't have domain.local in the SAN of the certificate. Is there a way to modify the template that issues that cert to add a SAN with just the Forest domain? Is this something people regularly do? What's the usual measure to get this to work?

Answer 1

Hello John Owens,

Thank you for posting in Q&A forum.

Did you have ADCS installed in your domain? If so, you can select "Supply in the request" on certificate template under "Subject Name" tab.

For example:

Then provide the SAN information during you enroll certificate as below: I hope the information above is helpful. If you have any questions or concerns, please feel free to let us know. Best Regards, Daisy Zhou

If the Answer is helpful, please click "Accept Answer" and upvote it.