1

i'm getting ready to take our new SP2016 farm out to Internet. We currently have 7 servers running WFE, DC, Search, APP, DB, OOS, and WFM. The web front-end will go thru a reverse proxy server.

I'm not too sure which servers will require SSL certificate and external domain in order for them to work properly. I know WFE will definitely require one, but will Office Online Server and Workflow manager require one as well? Or once it goes thru the the reverse proxy server, self-signed certificate will be enough? Same thing for the domain, will the OOS and WFM require an external domain?

Improve this question

1 Answer 1

Reset to default
5

Regardless of environment, the entire configuration should be using SSL. This includes your Web Applications, including Central Administration, Office Online Server, and Workflow Manager.

Only your FE(s) and OOS servers need to be exposed to the Internet [via your Reverse Proxy].

OOS and WFM both use OAuth (JWT) which, if sent over plain text HTTP, can be intercepted and replayed presenting a security risk.

Improve this answer
2
  • Thank you sir! Between them, they do use SSL and self-signed certs. I was referring to paid certificates when I bring them out to internet. Much appreciated for the confirmation!
    – David L.
    Commented Apr 24, 2017 at 21:01
  • For SharePoint and OOS, yes you'll need public certs. WFM can remain on a private cert.
    – user6024
    Commented Apr 24, 2017 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.