This issue may be encountered you are trying to achieve Email Authentication using certificates and they are leveraging the AirWatch Secure Email Gateway. After the Kerberos configuration, during testing you receive an error in the IIS logs that states 403 7. This error is observed in both Same Domain and Cross Domain Kerberos configurations.
This is caused because IIS configuration on the SEG server for the Microsoft Server Active Sync Endpoint is set to accept client certificates, but the server is not receiving client certificates.
Confirm that there is no component before the SEG Server which could be consuming the SSL certificate. Kerberos configuration is not supported when SSL Offloading or SSL bridging the traffic before the SEG server.