Fix CERTSRV_E_SUBJECT_ALT_NAME_REQUIRED (0X80094803) Now
This error means your cert request is missing a Subject Alternate Name (SAN). The fix is to add the SAN field. Don't waste time on other stuff.
You're getting this error because the Certificate Authority is picky about SANs
I've seen this exact error (0X80094803) on dozens of servers—Windows Server 2012 R2, 2016, 2019, you name it. The CA template says "Subject Alternate Name required" and your request doesn't have one. It's that simple. Let's fix it.
The Main Fix: Add a SAN to Your Certificate Request
Open your cert request (a .inf or .req file) and add a SAN extension. Here's a working example for a web server:
[NewRequest]
Subject = "CN=webserver.contoso.com"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = FALSE
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
[Extensions]
2.5.29.17 = "{text}dns=webserver.contoso.com&dns=webserver"If you're using the MMC certificate snap-in, check the box that says "Add SAN" in the request wizard. For IIS, edit the request template to include the SAN field. Don't bother with restarting services—that rarely helps here.
Why This Works
Modern CAs (especially on Windows Server 2016+) enforce SAN requirements for SSL/TLS certificates. The old CN-only method is dead. The CA checks the SAN extension first. If it's missing, you get 0X80094803. Adding the SAN tells the CA "I know what I'm doing."
Less Common Variations
- Template says SAN but request is old: Your CA template might require SAN but your request format doesn't include it. Recreate the request using the correct template.
- Web enrollment page: If you're using the web cert enrollment page, make sure you select a template that allows SAN. Some templates like "Web Server" do, others don't.
- SAN in ADCS auto-enrollment: Group Policy auto-enrollment sometimes skips SAN for computer certs. Edit the GPO template to enable SAN.
- Third-party CA: If you're using a third-party CA like DigiCert or Let's Encrypt, this error can still show up if their signer requires SAN. Add it.
Prevention for Next Time
Stop using CN-only requests. Every certificate you request should have a SAN, even for internal names. Set up your CA template to require SAN by default. In the Certificate Template Console, right-click your template, go to the Extensions tab, and enable "Subject Alternative Name." Check the box that says "Require for enrollment." This forces all future requests to include SAN. You'll never see 0X80094803 again.
Also, use certreq.exe with a proper .inf file. It's more reliable than the GUI. Save this as a template:
[Version]
Signature = "$Windows NT$"
[NewRequest]
Subject = "CN=PUT-YOUR-NAME-HERE"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = FALSE
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
[Extensions]
2.5.29.17 = "{text}dns=PUT-YOUR-SAN-HERE"Run: certreq -new template.inf request.req then submit. That's it.
Was this solution helpful?