--- title: Everything you learned about SSL is deprecated - Todd... description: A comprehensive historical walkthrough of SSL/TLS evolution, covering why nearly everything developers learned about SSL is now outdated. Key topics include:... canonical: https://daily.dev/posts/everything-you-learned-about-ssl-is-deprecated---todd-gardner---ndc-toronto-2026-qu558gqjt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Everything you learned about SSL is deprecated - Todd Gardner - NDC Toronto 2026 | daily.dev og:description: A comprehensive historical walkthrough of SSL/TLS evolution, covering why nearly everything developers learned about SSL is now outdated. Key topics include:... og:url: https://daily.dev/posts/everything-you-learned-about-ssl-is-deprecated---todd-gardner---ndc-toronto-2026-qu558gqjt og:image: https://api.daily.dev/og/posts/Qu558GqjT.png og:image:alt: Everything you learned about SSL is deprecated - Todd Gardner - NDC Toronto 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Everything you learned about SSL is deprecated - Todd Gardner - NDC Toronto 2026 **[NDC Conferences](https://daily.dev/sources/ndc)** · 50 min read · 0 upvotes · 0 comments ## Summary A comprehensive historical walkthrough of SSL/TLS evolution, covering why nearly everything developers learned about SSL is now outdated. Key topics include: why the old Stack Overflow CSR commands are wrong today (RSA 2048, SHA-1), the history of CA failures (DigiNotar, Symantec), how certificate transparency logs changed accountability, the introduction of perfect forward secrecy in response to NSA surveillance revelations, the broken state of certificate revocation, Let's Encrypt's disruption of the paid CA model, and the upcoming mandatory shift to short-lived certificates (200 days in 2026, 47 days by 2029). The talk emphasizes that manual certificate management will become untenable and automation via ACME protocol is now essential. Post-quantum cryptography is flagged as the next major disruption on the horizon. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How short will TLS certificate lifetimes get and when do the changes take effect? Apple, Google, and Microsoft agreed on a phased reduction: certificate lifetimes dropped to 200 days in March 2026, will drop to 100 days the following year, and will reach 47 days by 2029. This replaces the prior 398-day maximum that Apple had unilaterally enforced since February 2020, and it means far more frequent manual or automated renewals for anyone managing certificates directly. _Track how certificate lifetime cuts affect renewal automation plans with daily.dev._ ### What is perfect forward secrecy and why was it added to TLS in 2013? Perfect forward secrecy separates a certificate's identity function from the encryption key so that a stolen private key can no longer decrypt previously recorded traffic. It was introduced in 2013 directly in response to Edward Snowden's NSA leaks, which revealed mass harvesting of encrypted traffic under the assumption that private keys could later be stolen or compelled to decrypt it. It works using Diffie-Hellman key exchange to generate a new one-time session key each time. _Developers hardening TLS configs can follow forward secrecy tradeoffs on daily.dev._ ### Why is TLS certificate revocation considered broken? Certificate revocation checking has never worked reliably: certificate revocation lists didn't scale, the online certificate status protocol (OCSP) was unreliable and leaked browsing privacy, OCSP stapling was too hard to implement so adoption stalled, and browsers ultimately fell back to shipping only a small subset (about 1%) of high-priority revocations via CRLSet-style lists. As a result, whether a revoked certificate is actually blocked varies by browser and by the moment you check. _Anyone debugging certificate trust failures can follow revocation mechanics on daily.dev._ ## Similar posts on daily.dev - [From 398 Days to 47: Why Website Security Certificates Are Getting Shorter?](https://daily.dev/posts/from-398-days-to-47-why-website-security-certificates-are-getting-shorter--romldzze9) · Latest Hacking News · 0 upvotes · 0 comments - [How CISOs can prepare for the new era of short-lived TLS certificates](https://daily.dev/posts/how-cisos-can-prepare-for-the-new-era-of-short-lived-tls-certificates-vpcjrpss7) · CSO Online · 0 upvotes · 0 comments - [Get Ready for Seven-Day Certificates](https://daily.dev/posts/get-ready-for-seven-day-certificates-w0h4xywql) · Feisty Duck · 0 upvotes · 0 comments - [Upcoming Changes to Let’s Encrypt Certificates](https://daily.dev/posts/upcoming-changes-to-let-s-encrypt-certificates-uaictqhyk) · Hacker News · 1 upvotes · 0 comments - [Why Certificate Management Has to Change Webinar](https://daily.dev/posts/why-certificate-management-has-to-change-webinar-thgseamel) · Tech Lead Digest · 0 upvotes · 0 comments --- Tags: [#quantum-computing](https://daily.dev/tags/quantum-computing), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/everything-you-learned-about-ssl-is-deprecated---todd-gardner---ndc-toronto-2026-qu558gqjt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Everything you learned about SSL is deprecated - Todd Gardner - NDC Toronto 2026","url":"https://daily.dev/posts/everything-you-learned-about-ssl-is-deprecated---todd-gardner---ndc-toronto-2026-qu558gqjt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/everything-you-learned-about-ssl-is-deprecated---todd-gardner---ndc-toronto-2026-qu558gqjt"},"datePublished":"2026-07-31T10:39:44.671Z","dateModified":"2026-09-14T07:52:19.729Z","description":"A comprehensive historical walkthrough of SSL/TLS evolution, covering why nearly everything developers learned about SSL is now outdated. Key topics include:...","image":"https://i.ytimg.com/vi/-9KiLFr8_hI/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/-9KiLFr8_hI/sddefault.jpg","isAccessibleForFree":true,"articleSection":"NDC Conferences","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"NDC Conferences","logo":"https://media.daily.dev/image/upload/s--SiIyojEj--/f_auto/v1748760369/logos/ndc","url":"https://daily.dev/sources/ndc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/everything-you-learned-about-ssl-is-deprecated---todd-gardner---ndc-toronto-2026-qu558gqjt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"quantum-computing,cryptography","timeRequired":"PT50M","video":{"@type":"VideoObject","name":"Everything you learned about SSL is deprecated - Todd Gardner - NDC Toronto 2026","description":"A comprehensive historical walkthrough of SSL/TLS evolution, covering why nearly everything developers learned about SSL is now outdated. Key topics include:...","thumbnailUrl":"https://i.ytimg.com/vi/-9KiLFr8_hI/sddefault.jpg","uploadDate":"2026-07-31T10:39:44.671Z","duration":"PT50M","url":"https://api.daily.dev/r/Qu558GqjT","embedUrl":"https://www.youtube.com/embed/-9KiLFr8_hI"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"NDC Conferences","item":"https://daily.dev/sources/ndc"},{"@type":"ListItem","position":3,"name":"Everything you learned about SSL is deprecated - Todd Gardner - NDC Toronto 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/everything-you-learned-about-ssl-is-deprecated---todd-gardner---ndc-toronto-2026-qu558gqjt#faq","mainEntity":[{"@type":"Question","name":"How short will TLS certificate lifetimes get and when do the changes take effect?","acceptedAnswer":{"@type":"Answer","text":"Apple, Google, and Microsoft agreed on a phased reduction: certificate lifetimes dropped to 200 days in March 2026, will drop to 100 days the following year, and will reach 47 days by 2029. This replaces the prior 398-day maximum that Apple had unilaterally enforced since February 2020, and it means far more frequent manual or automated renewals for anyone managing certificates directly. Track how certificate lifetime cuts affect renewal automation plans with daily.dev."}},{"@type":"Question","name":"What is perfect forward secrecy and why was it added to TLS in 2013?","acceptedAnswer":{"@type":"Answer","text":"Perfect forward secrecy separates a certificate's identity function from the encryption key so that a stolen private key can no longer decrypt previously recorded traffic. It was introduced in 2013 directly in response to Edward Snowden's NSA leaks, which revealed mass harvesting of encrypted traffic under the assumption that private keys could later be stolen or compelled to decrypt it. It works using Diffie-Hellman key exchange to generate a new one-time session key each time. Developers hardening TLS configs can follow forward secrecy tradeoffs on daily.dev."}},{"@type":"Question","name":"Why is TLS certificate revocation considered broken?","acceptedAnswer":{"@type":"Answer","text":"Certificate revocation checking has never worked reliably: certificate revocation lists didn't scale, the online certificate status protocol (OCSP) was unreliable and leaked browsing privacy, OCSP stapling was too hard to implement so adoption stalled, and browsers ultimately fell back to shipping only a small subset (about 1%) of high-priority revocations via CRLSet-style lists. As a result, whether a revoked certificate is actually blocked varies by browser and by the moment you check. Anyone debugging certificate trust failures can follow revocation mechanics on daily.dev."}}]} ```