Skip to content

[API/YAML] Android certificates: support for subject alternative name (SAN) attributes in certificates #43318

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rachaelshaw merged 4 commits into from
Apr 14, 2026
+14 −6
Merged

[API/YAML] Android certificates: support for subject alternative name (SAN) attributes in certificates #43318

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9284ed4
Update rest-api.md
marko-lisica Apr 9, 2026
f50112a
update
marko-lisica Apr 9, 2026
974ac42
update
marko-lisica Apr 9, 2026
8c5dbc3
update yaml
marko-lisica Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/Configuration/yaml-files.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -410,6 +410,7 @@ controls:
- name: wifi-certificate
certificate_authority_name: EST_WIFI
subject_name: /CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL
Copy link
Copy Markdown
Member Author

@marko-lisica marko-lisica Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rachaelshaw, this is the wrong format, but I opened PR to main: #43317

subject_alternative_name: "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME
macos_setup: # Available in Fleet Premium
bootstrap_package: https://example.org/bootstrap_package.pkg
enable_end_user_authentication: true
Expand Down Expand Up @@ -465,7 +466,8 @@ Use `labels_include_all` to target hosts that have all labels, `labels_include_a

- `name` is the name of the certificate. Name can be used as a certificate alias to reference in configuration profiles (custom settings).
- `certificate_authority_name` is the name of the [certificate authority (CA)](#certificate-authorities) to issue the certificate from. Currently, only a custom SCEP CA is supported.
- `subject_name` is the certificate's subject name (SN). Separate subject fields by a "/". For example: "/CN=john@example.com/O=Acme Inc.".
- `subject_name` is the certificate's subject name (SN). Separate subject fields by a ",". For example: "/CN=john@example.com/O=Acme Inc.".
- `subject_alternative_name` is the certificate's subject alternative name (SAN). Separate fields by a ",". For example: "UPN=john@example".

#### Variables

Expand Down
16 changes: 11 additions & 5 deletions docs/REST API/rest-api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -753,7 +753,8 @@ Add a certificate template to deploy a certificate to all hosts on the fleet. Fl
| name | string | body | **Required.** The name of the certificate. Name can be used as certificate alias to reference in configuration profiles. |
| fleet_id | string | body | _Available in Fleet Premium_. The ID of the fleet to add profiles to. |
| certificate_authority_id | integer | body | **Required.** The certificate authority (CA) ID to issue certificate from. Currently, only custom SCEP CA is supported. To get ID use [List certificate authorities](#list-certificate-authorities-cas). |
| subject_name | string | body |**Required** The certificate's subject name (SN). Separate subject fields by a "/". For example: "/CN=john@example.com/O=Acme Inc.". |
| subject_name | string | body |**Required** The certificate's subject name (SN). Separate subject fields by a ",". For example: "CN=john@example.com,O=Acme Inc.". |
| subject_alternative_name | string | body | The certificate's subject alternative name (SAN). Separate SAN fields by a ",". For example: "DNS=example.com,UPN=marko@example.com". |

#### Example

Expand All @@ -767,7 +768,9 @@ Add a certificate template to deploy a certificate to all hosts on the fleet. Fl
"team_id": 1,
"fleet_id": 1,
"certificate_authority_id": 1,
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL"
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL",
"subject_alternative_name": "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME"

}
```

Expand All @@ -780,7 +783,8 @@ Add a certificate template to deploy a certificate to all hosts on the fleet. Fl
"certificate_authority_id": 1,
"id": 1,
"name": "wifi-certificate",
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL"
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL",
"subject_alternative_name": "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME"
}
```

Expand Down Expand Up @@ -984,6 +988,7 @@ Authorization: Bearer sunVIQ+wqYQvJlXf1aqYTt8LrlUGKBigNdWmdH5bhT1MH
"certificate_authority_id": "1",
"certificate_authority_name": "PRODUCTION_SCEP_SERVER",
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL",
"subject_alternative_name": "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME",
"created_at": "2025-11-04T00:00:00Z",
},
{
Expand Down Expand Up @@ -1013,7 +1018,7 @@ Get details of the certificate added to Fleet.
| Name | Type | In | Description |
|---------------- |-------- |------|-------------------------------------------------------------|
| id | integer | path | **Required**. The ID of the certificate. |
| host_id | integer | query | ID of the host. If included, variables in `subject_name` will be replaced with host's values. |
| host_id | integer | query | ID of the host. If included, variables in `subject_name`, and `subject_alternative_name` will be replaced with host's values. |

#### Request headers

Expand Down Expand Up @@ -1062,7 +1067,8 @@ Authorization: Bearer sunVIQ+wqYQvJlXf1aqYTt8LrlUGKBigNdWmdH5bhT1MH
"created_at": "2025-11-04T00:00:00Z",
"id": 1,
"name": "wifi-certificate",
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL",
"subject_name": "CN=marko@example.com, O=Fleet Inc",
"subject_alternative_name": "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME"
}
```

Expand Down
Loading