I'm only chiming in here because we do the same. We have an AD! Bizarrely it is actually rather easy to use despite the nightmare of rubbish docs on t'internets. We use winbindd (SSSD is another well respected option - must try it) and the algorithmic idmap backend which guarantees the same uid/gid on all Linux boxes. winbindd also sorts out Kerberos keytabs for the machine itself ("join the domain") and logged in used via winbind's NSS and PAM add ons. Finally, winbind can cache logins for offline logins which is nice for say this laptop that I am using right now.

All browsers that I use (IE, Chrom{e|ium}, Firefox) support GSSAPI. Apache, IIS, nginx support GSSAPI. OpenSSH and PuTTY support GSSAPI. There is a lot of support for it out there. Oh and of course Squid for all your proxy needs and HAProxy works as expected (I use it to front Exchange to get PCI DSS compliance even for Exchange 2010 - but that is more a TLS thing). Evolution EWS works through that lot using Kerberos for auth for the full Exchange client experience, including calendaring, without needing Outlook.

Kerb is for auth whereas SSL is for encryption. I think you may be confusing use cases a bit. To be fair all that stuff can be a bit confusing and there is a lot of overlap. SSL can be used for identity proof (often proof by assertion) and so can Kerberos (proof by faith in the rest of your realm)