CSR with more than 4 SANs

[GrantCampbell4]

Hello,

We are operating a GlobalProtect environment that uses a generic Server SSL cert with a shared common name and the certificate lists multiple subject alternate FQDN names.

We are about to expand the GP Gateway numbers and need to add the SANs into a new CSR.  But we see that Palo Alto only supports a limit of four (4) SANs "hostname" entries.

Historically we had skilled PKI engineers who would add SANs for us at the server but we have lost access to that technical capability.  Our current PKI team refuse to do this.

I hear rumors that the cli has a capability to generate certificates with an increased number of SAN capability.

Does anyone have any "facts" as to limits on the cli and how to do this for a given template for specific appliances via Panorama?

Or a clever way of doing this via another method.  

Thanks & Regards