From 9284ed458b8f00afa2d5720ad40479740855cbc3 Mon Sep 17 00:00:00 2001 From: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Date: Thu, 9 Apr 2026 15:25:39 +0200 Subject: [PATCH 1/4] Update rest-api.md --- docs/REST API/rest-api.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md index df3729fa632..c5283b66b3d 100644 --- a/docs/REST API/rest-api.md +++ b/docs/REST API/rest-api.md @@ -753,7 +753,8 @@ Add a certificate template to deploy a certificate to all hosts on the fleet. Fl | name | string | body | **Required.** The name of the certificate. Name can be used as certificate alias to reference in configuration profiles. | | fleet_id | string | body | _Available in Fleet Premium_. The ID of the fleet to add profiles to. | | certificate_authority_id | integer | body | **Required.** The certificate authority (CA) ID to issue certificate from. Currently, only custom SCEP CA is supported. To get ID use [List certificate authorities](#list-certificate-authorities-cas). | -| subject_name | string | body |**Required** The certificate's subject name (SN). Separate subject fields by a "/". For example: "/CN=john@example.com/O=Acme Inc.". | +| subject_name | string | body |**Required** The certificate's subject name (SN). Separate subject fields by a ",". For example: "CN=john@example.com,O=Acme Inc.". | +| subject_alternative_name | string | body | The certificate's subject alternative name (SAN). Separate SAN fields by a ",". For example: "DNS=example.com,UPN=marko@example.com". | #### Example From f50112acbc7d26f6e5ebbdd7ec93cadb950ba642 Mon Sep 17 00:00:00 2001 From: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Date: Thu, 9 Apr 2026 15:31:51 +0200 Subject: [PATCH 2/4] update --- docs/REST API/rest-api.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md index c5283b66b3d..627c8eb9021 100644 --- a/docs/REST API/rest-api.md +++ b/docs/REST API/rest-api.md @@ -768,7 +768,9 @@ Add a certificate template to deploy a certificate to all hosts on the fleet. Fl "team_id": 1, "fleet_id": 1, "certificate_authority_id": 1, - "subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL" + "subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL", + "subject_alternative_name": "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME" + } ``` @@ -781,7 +783,8 @@ Add a certificate template to deploy a certificate to all hosts on the fleet. Fl "certificate_authority_id": 1, "id": 1, "name": "wifi-certificate", - "subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL" + "subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL", + "subject_alternative_name": "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME" } ``` @@ -1014,7 +1017,7 @@ Get details of the certificate added to Fleet. | Name | Type | In | Description | |---------------- |-------- |------|-------------------------------------------------------------| | id | integer | path | **Required**. The ID of the certificate. | -| host_id | integer | query | ID of the host. If included, variables in `subject_name` will be replaced with host's values. | +| host_id | integer | query | ID of the host. If included, variables in `subject_name`, and `subject_alternative_name` will be replaced with host's values. | #### Request headers @@ -1064,6 +1067,7 @@ Authorization: Bearer sunVIQ+wqYQvJlXf1aqYTt8LrlUGKBigNdWmdH5bhT1MH "id": 1, "name": "wifi-certificate", "subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL", + "subject_alternative_name": "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME" } ``` From 974ac42e2c3d58592aaa96a2ead541ba3b0bf7dc Mon Sep 17 00:00:00 2001 From: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Date: Thu, 9 Apr 2026 16:46:47 +0200 Subject: [PATCH 3/4] update --- docs/REST API/rest-api.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md index 627c8eb9021..a70e3ba8ac5 100644 --- a/docs/REST API/rest-api.md +++ b/docs/REST API/rest-api.md @@ -988,6 +988,7 @@ Authorization: Bearer sunVIQ+wqYQvJlXf1aqYTt8LrlUGKBigNdWmdH5bhT1MH "certificate_authority_id": "1", "certificate_authority_name": "PRODUCTION_SCEP_SERVER", "subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL", + "subject_alternative_name": "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME", "created_at": "2025-11-04T00:00:00Z", }, { @@ -1066,7 +1067,7 @@ Authorization: Bearer sunVIQ+wqYQvJlXf1aqYTt8LrlUGKBigNdWmdH5bhT1MH "created_at": "2025-11-04T00:00:00Z", "id": 1, "name": "wifi-certificate", - "subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL", + "subject_name": "CN=marko@example.com, O=Fleet Inc", "subject_alternative_name": "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME" } ``` From 8c5dbc33779f12cee93204047b81c0e2e94b0a83 Mon Sep 17 00:00:00 2001 From: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Date: Thu, 9 Apr 2026 16:49:49 +0200 Subject: [PATCH 4/4] update yaml --- docs/Configuration/yaml-files.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/Configuration/yaml-files.md b/docs/Configuration/yaml-files.md index f802eaec7b4..b30a6f05a5f 100644 --- a/docs/Configuration/yaml-files.md +++ b/docs/Configuration/yaml-files.md @@ -410,6 +410,7 @@ controls: - name: wifi-certificate certificate_authority_name: EST_WIFI subject_name: /CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL + subject_alternative_name: "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME macos_setup: # Available in Fleet Premium bootstrap_package: https://example.org/bootstrap_package.pkg enable_end_user_authentication: true @@ -465,7 +466,8 @@ Use `labels_include_all` to target hosts that have all labels, `labels_include_a - `name` is the name of the certificate. Name can be used as a certificate alias to reference in configuration profiles (custom settings). - `certificate_authority_name` is the name of the [certificate authority (CA)](#certificate-authorities) to issue the certificate from. Currently, only a custom SCEP CA is supported. -- `subject_name` is the certificate's subject name (SN). Separate subject fields by a "/". For example: "/CN=john@example.com/O=Acme Inc.". +- `subject_name` is the certificate's subject name (SN). Separate subject fields by a ",". For example: "/CN=john@example.com/O=Acme Inc.". +- `subject_alternative_name` is the certificate's subject alternative name (SAN). Separate fields by a ",". For example: "UPN=john@example". #### Variables