How to use variables with certificates for ChromeOS

Problem

How can you use variables to customize certificates on ChromeOS devices?

Environment

  • SCEP certificates.
  • ChromeOS devices.

Solution

You can use variable for SAN but only the supported ones. This is the list of the supported ones:
  
${DEVICE_DIRECTORY_ID}—Device’s directory ID
${USER_EMAIL}—Signed-in user’s email address
${USER_EMAIL_DOMAIN}—Signed-in user’s domain name
${DEVICE_SERIAL_NUMBER}—Device's serial number
${DEVICE_ASSET_ID}—Asset ID assigned to device by administrator
${DEVICE_ANNOTATED_LOCATION}—Location assigned to device by administrator
${USER_EMAIL_NAME}—First part (part before @) of signed-in user’s email address