SSL certificate conversion to AD Kerberos credentials

Absolutely. An example for Apache can be found here: https://devcentral.f5.com/articles/us-federal-enabling-kerberos-for-smartcard-authentication-to-apache?tag=federal

The main difference between Apache and IIS on the APM side is switching from on 401 to Always in the SSO profile, and also you dont need to generate any Keytabs on a windows server (unless you want to) and you can just use a service account.