Is it possible to create an internal SSL certificate with Subject Alternative Names

Solution 1:

You have to enable SANs on the CA server:

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc
net start certsvc

Solution 2:

A Windows CA certainly can issue a certificate with a Subject Alternate Name, you just need to make a little tweak on the certificate server.

Run the following commands one after another in cmd.exe (you'll need to elevate on Windows Server 2008 or later).

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc
net start certsvc

You should probably run through Security best practices for allowing SANs in certificates on TechNet before you do, for some things to be aware of.