This article is part of our series on extending Microsoft AD CS beyond its design boundaries. Previous articles covered Linux certificate automation, DevOps and ACME pipeline integration, and AD CS auto-enrollment at scale across large Windows fleets. This one focuses on a specific and frequently frustrating gap: web server certificate management. If your priority is non-Windows enrollment, governance and policy modules, or certificate-based authentication mapping, those topics are covered in other articles in this series. This one is for infrastructure and operations managers who assumed that AD CS auto-enrollment would handle their IIS certificates the same way it handles machine certificates — and discovered, usually at the worst moment, that it doesn't quite.