My company's SSL Certificate for basically all their websites and Activesync servers have expired long ago. For my upcoming meeting's sake I need to explain how this is very insecure. Unfortunately I am not too read up on the subject of these security flaws.
Will it be possible now to poison the DNS and engage Man-in-the-Middle attacks without a proper SSL certificate?
If the DNS has indeed been poisoned, is it possible to imitate an exchange ActiveSync server to hijack all incoming and outgoing emails, including taking over staff's phone?
What are the implications and consequences of not having a valid SSL certificate?
I've read up online on the benefits of having a SSL certificate, but no one seems to enjoy talking about how an actual attack is carried out. Please list terminology, so I can maybe google-fu my way around this issue.