FTD SCEP multiple SANs

[jturner2720]

With the talk of certificate lifetimes dropping to 90 days, we're looking at ways to automate certificate provisioning.

I see in the FMC GUI that there's an option to use SCEP to retrieve certificates automatically, but I don't see anywhere where you can specify the SANs in the certificate. With the current manual approach, we put all the hostnames of the various nodes involved in the SSL VPN as potentially any could be used.

Am I missing something, or is this just something SCEP can't do? What do other people running VPNs do for their certificates? (Just the certificate for the device(s), rather than client authentication).

Thanks in advance.

[MHM Cisco World]

It must appear in enrollment type' what option you have ?

If you dont see it what is fmc ver. You have 

MHM

[jturner2720]

SCEP appears as an enrolment type, it's being able to configure options therein that I was asking about.

We're running 7.4.1.

[tvotna]

SCEP can do that, but ASA/FTD cannot. Generate certificate somewhere else and then import it to all FTD nodes.