Lol oh I never said it’s a good solution. The worst part isn’t running IIS, it’s running IIS on a donation controller. The better option is using a different domain for AD than your web domain, as long as it’s a publicly registered domain for certificate purposes.