The cert for our public facing site is about to expire soon. Our site is entirely http. The site runs on SharePoint, and with SharePoint working with NTLM, the credentials that are passed over the site are done so securely (not in plain text). This is for users going to the site and making basic changes (text/images). Once they are authenticated, they edit the site on http.

So, is there any need for us to renew our cert?



If the certificate is there, then chances are that it is used for something, and that something will probably break when the certificate expires.

In your case, if you use pure NTLM, then it seems that no certificate is used at all, so maybe you can let the certificate die and see that nothing happens. However, authentication in SharePoint can be complex so I won't claim to give any definite guarantee here.

Note, though, that the NTLM protocol is vulnerable to offline dictionary attacks: someone observing the traffic won't see the passwords "as is", but will learn enough to "try passwords at home" at a rate limited only by the number of PC that the attacker can muster -- and that will be counted in dozens of millions per second. Not many user-chosen passwords last long under these conditions. And, of course, a HTTP-only site is easy prey to attackers: if you use authentication, then you fear unauthorized accesses; if the data is confidential then a passive eavesdropper will see the data as it is retrieved by normal users; and an active attacker can hijack connections at will (that's the classic Man-in-the-Middle: the attacker forwards bytes in both direction, and when the authentication has been done, he takes control of the connection).

In simple words: if you really need some security in your case, then it seems highly implausible that you can get away with not using SSL. And if you do not need some security, then why are use using authentication at all ?

  • Good points, Tom. I'd like to add that you can test if the cert expiration will cause a problem by changing the time on a computer (not the server) to sometime after the cert expires. If no errors come up, you should be OK. That being said, keep the cert. Check out StartSSL, which has free one-year SSL certs. Ideally, I think almost all sites should be SSL all the time. Apr 22 '14 at 17:17
  • Thank you both - I hadn't seen anything out there where someone had answered this question. We are using more than just NTLM and have been assured from our main vendor that authentication is done in a secure manner and passwords aren't passed in plain text. I don't think that we need any security outside of making sure the authentication is encrypted. I am going to hold off renewing the cert, and I'll report back here what happens (2 days til cert expires).
    – Chris
    Apr 22 '14 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.