SharePoint 2013 - SSL Offloading via F5 & Move HNSC's to seperate webapp

Question

Hi everyone,

I was wondering if you could please share you thoughts on the following.

We need to extend our SharePoint 2013 hosted web apps to FQDN's to allow them to be exposed via an Azure Application Proxy to our O365 Tenant.

Along with this, the sites/webapps will need to be accessible using https.

My question is:

1. Should we encrypt all the way through to the SharePoint environment, or should we utilise our F5 appliance to facilitate SSL Offloading?
   What would the benefits off either scenario be?
2. Should we move our HNSC's to separate web apps to allow for easier extension, and application of SSL Certs if SSL Offloading on the F5 is not chosen?

Thanks

Answer 1

I encrypt all the way to SharePoint as OAuth tokens (if using Office Web Apps/Office Online Server, Workflow Manager, Exchange integration, SharePoint addins) require transport security; OAuth tokens can be intercepted and replayed if sent in the clear, allowing an attacker to impersonate the user.