1

My company's SSL Certificate for basically all their websites and Activesync servers have expired long ago. For my upcoming meeting's sake I need to explain how this is very insecure. Unfortunately I am not too read up on the subject of these security flaws.

  1. Will it be possible now to poison the DNS and engage Man-in-the-Middle attacks without a proper SSL certificate?

  2. If the DNS has indeed been poisoned, is it possible to imitate an exchange ActiveSync server to hijack all incoming and outgoing emails, including taking over staff's phone?

  3. What are the implications and consequences of not having a valid SSL certificate?

I've read up online on the benefits of having a SSL certificate, but no one seems to enjoy talking about how an actual attack is carried out. Please list terminology, so I can maybe google-fu my way around this issue.

1

an expired SSL certificate means:

  • There is no more way to validate the authenticity of the certificate. (I can no longer tell if its correct, or replaced by an attackers).
  • All proper software will complain every time I connect with this service, which trains people to ignore the messages. So when an attacker does the same no one reports anything.
  • the way the certificate and key are made could be outdated. (a MD5 hash is easily to find an collision for, as example).
  • The longer a key is in use, the higher the changes of someone breaking or stealing it. To limit this certificate expiration was invented.
  • As for the money to replace the certificates. SSL certificates are no longer as pricey as they ones were. most single domain certificates are below €10,-
  • an expired certificate also shows a lack of concern from management and IT. which undermines people's trust in the company.
  • etc...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.