Not sure if Dogtag is capable of this already or not. It would be helpful if it was possible to construct a Dogtag profile which automatically added SubjectAltName = CN (just assume that DNS:$CN for the SAN). Most of our users create server CSRs without requesting a SAN. We are starting to see browsers and applications enforce the SAN requirement (following CA/B requirements).

The logic might be:

if (CSR has existing SAN values) { copy existing SAN }
else { add SAN values where subjectAtlName=DNS:$CN }