NAT/Proxy 443 on domain controllers to outside web server

[hun]

How can I redirect Port 443 only to a different IP with the FortiGate?

Domain Controllers are in separate subnet, and all requests except port 443 should go to the real IP.

Port 443 should be redirected to an external webserver.

(for context: AD set up with split DNS, domain.com internal AD, and the same domain.com externally and we can't change or AD name, using www is not an option)