Setting Up a CA Template with SAN and Custom Settings

1. In the Certificate Templates node, right-click and select New → Certificate Template to Issue.
   
2. Select the template you just created and click OK.
   
3. You will now see the new template listed under the issued templates.
   

Generate an SSL Certificate Without CSR and Add Alternative Names

1. On the CA server or a domain-joined application server, run MMC.exe as Administrator.
2. Add the Certificates snap-in for the computer account.
   
3. Expand Certificates → Personal → Certificates.
   
4. Right-click Personal, go to All Tasks → Request New Certificate.
   
5. The Certificate Enrollment Wizard will open:
   • Click Next → Next again → Select the new template (created earlier).
   • If a warning icon appears, click on it to configure additional fields.
     
6. Under the Subject Tab:
   • Add a Subject Name as required.
   • Under Alternative Name, add the following (as applicable):
     • DNS: Add the FQDN of the server and application (e.g., server.domain.com, app.domain.com).
     • IP Address: Add the IP of the application server.
     • URL: Add the application URL (e.g., https://pba.pb.dash/*).
       
7. In the General Tab:
   • Set a Friendly Name for easy identification.
8. Leave other tabs as default, then click Apply and OK.
9. Click Enroll to complete the certificate request.
   

Exporting and Installing the Certificate on Another Server (If Needed)

If the certificate was created on a different server than the application server, follow these steps:

1. Right-click the certificate → All Tasks → Export.
2. In the Export Wizard:
   • Click Next.
   • Select Yes, export the private key.
     
   • Choose the .PFX format, then click Next.
     
   • Set a password to protect the private key.
   • Choose a save location, and click Finish to export the certificate.
3. On the target server, import the PFX certificate via MMC or IIS.

Assign an SSL Certificate in IIS

1. Open IIS Manager.
2. Navigate to Sites and select the appropriate site.
3. On the right panel, click Bindings.
   
4. Edit or add a binding for HTTPS.
5. In the SSL certificate dropdown, select the installed/enrolled certificate.
   
6. Click OK to apply the changes.
   

Conclusion

By following these steps, you can securely issue and apply an SSL certificate with custom subject names and SAN entries using your internal CA. If preferred, these additional settings can also be included in a CSR for manual submission.