Question: how do ad certificates work?
Answer: According to Microsoft, AD CS is the “Server Role that allows you to build a public key infrastructure (PKI) and provide public key cryptography, digital certificates, and digital signature capabilities for your organization.” ... You could also buy a few certificates from a CA like GlobalSign and install them manually.