5

Is it necessary to create a https enabling mechanism for implementing workflow manager in my SharePoint farm?

Am having 2 WFEs, 2 INDEXs and 1 SQL cluster on my prod. farm.

Am stuck with whether to go ahead with http or https though, MSFT says about going with https on a prod. Env: install-WF-Manager

The question is if I go ahead with https, with self-signed authority certificate what will be the impact of the SPD 2013 workflows I have created and published on this farm? Will I get errors while access the task lists/ custom approvals forms?

5

Whether to go with HTTP o HTTPS for WFM in a SharePoint 2013 Production Farm?

It's heavily recommended to go ahead with HTTPS

By the way, You have 4 possible scenarios to install Workflow Manager for SharePoint farm

  1. Workflow Manager is installed on a server that is part of the SharePoint 2013 farm. Communication takes place by using HTTP.
  2. Workflow Manager is installed on a server that is part of the SharePoint 2013 farm. Communication takes place by using HTTPS.
  3. Workflow Manager is installed on a server that is NOT part of the SharePoint 2013 farm. Communication takes place by using HTTP.
  4. Workflow Manager is installed on a server that is NOT part of the SharePoint 2013 farm. Communication takes place by using HTTPS.

The preferred scenario to be deployed on production is number 4 but it's costly. for more details read CONFIGURE WORKFLOW MANAGER FOR SHAREPOINT

If I go ahead with https, with self-signed authority certificate in production

I don't complete the question because we should stop here Because the Self-Signed Certification should be never used in Production!!!! it's risky and not trusted!

2

@M.Qassas answer is more complete, but HTTPS should always be used in production environments, because the authentication between servers (SharePoint and WFM) uses OAuth. OAuth does not encrypt the credential exchange.

  • Out of the answers, this is absolutely the correct answer. HTTP should never be used, regardless of environment, unless you must be able to sniff the network packets and don't have the means to perform decryption with your tooling of choice. OAuth tokens should be considered to contain usernames and passwords. They can be intercepted and replayed; the attacker can gain access to the resource as the particular user. I wrote about the above at thesharepointfarm.com/2014/09/dangers-allowhttp-sharepoint. – Trevor Seward Jun 13 '17 at 16:05
1

I agree with M.Qassas. If your SharePoint Farm is accessible via internet and if you want to configure Workflow manager outside the SharePoint farm which is accessible via internet than it should be HTTPS. If it is intranet communication HTTP works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.