AD / LDAP UID vs UserPrincipalName

You may use a letsencrypt cert:

http://docs.nethserver.org/en/v7/base_system.html#server-certificate

…and put it to the samba container: