I'm setting up Identity Connect so our employees can authenticate against AD and get logged in to SF.
While it mostly works, I don't want the users to see browser warnings about invalid certificates.
From the admin/settings/SSL page in IC, I generated a CSR. However, that CSR is missing the subjectAlternativeName field.
Without that, getting the CSR signed and uploading the cert doesn't do me much good. As of Chrome 58, the SSL cert must have the SAN field or the user gets a big warning page about an invalid cert.
Is there some way to fix this? The IC guide shows how to generate a CSR via command line with keytool, but that seems to only be for Linux.
The only workaround I see so far is to use a GPO to tell Chrome to allow the cert without SAN. But that's just a short-term workaround. I'd prefer a proper fix.
Do I have to wait for Salesforce to fix Identity Connect?