Template:

[NewRequest]
Subject = "CN=devname.fi.tcsecp.com"
Exportable = TRUE
KeyLength = 2048
KeySpec = 1
KeyUsage = 0xf0
RequestType = PKCS10

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=devname.fi.tcsecp.com"

[RequestAttributes]
CertificateTemplate = WebServer

For SAN, tried using the following which did not work. So, use the [Extensions] format mentioned above.

[RequestAttributes] ; If your client operating system is Windows Server 2003, Windows Server 2003 R2, or Windows XP ; and you are using a standalone CA, SANs can be included in the RequestAttributes ; section by using the following text format. SAN="dns=www01.fabrikam.com&dns=www.fabrikam.com&ipaddress=172.31.10.130"

---

references: How to Request a Certificate With a Custom SAN | Microsoft Docs