You can't expect the CA to permit IIS to enrol for a certificate for all your SNI sites and the CA doesn't know that you own those names. If the CA issues certificates for any Subject the client requests, then it wouldn't be much of an authority :-)
Instead, you will somehow need to show that you do own, or at least are responsible for, those names. This is where protocols such as ACME are used on the Internet, as it is used to show to the CA that you do own a specific FQDN. Unfortunately, Microsoft ADCS doesn't support ACME without third party tools.
What you can do instead though is issue the certificate using a template which initially requires CA certificate manager approval and is configured to subsequently renew the certificate without requiring the CA manager to approve it, thereby reducing the workload. In this scenario, the CA certificate manager will have a responsibility to verify that you are responsible for all those names.
- On the template Subject Name tab, set the template to Supply in the request, then select Use subject information from existing certificate for autoenrollment renewal requests.
- On the Issuance Requirements tab set the Require the following for enrollment to CA certificate manager approval, then from Require the following for reenrollment below, to Valid existing certificate.
Ensure that the Certificate Client Services - Auto-Enrollment Group Policy is enabled and Renew expired certificates, update pending certificates, and remove revoked certificates and Update certificates that use certificate templates are both set.
Have the CA administrator enable this template on your CA, then enrol for it from the IIS server.
You will need to add all the Subject and Subject Alternative Name fields to this certification request on initial enrolment only.
On renewal, the client will automatically submit a request to the CA using the information stored in the Subject and Subject Alternative Name fields. As this request is signed by (the private key of) a valid existing certificate, the CA will trust it and therefore instead of requiring the CA certificate manager to approve the request again, it will automatically issue it.
A downside to this approach is that if you host a new site and need to add another SNI name to the Subject Alternative Name extension, then you will have to generate a new request from scratch and have the CA certificate manager approve it.
