Everything you learned about SSL is deprecated - Todd Gardner - NDC Toronto 2026

Value of the Information & Strength of the Argument

The talk provides substantial value by consolidating a decade of security developments into a coherent narrative. Gardner’s argumentation is solid, backed by historical events and technical explanations. He effectively explains why old practices are deprecated and why new approaches are necessary. The use of real-world examples, such as the DigiNotar breach and Heartbleed, strengthens his points. However, some technical simplifications (e.g., the discrete logarithm explanation) could be more precise, but overall the argumentation is convincing and well-supported.

Scientific Rigor, Source Quality, Title Accuracy

The talk demonstrates strong scientific rigor, referencing real incidents, standards (RFC 6962), and industry practices. Gardner cites specific events and technologies, though he does not provide formal citations. The title accurately reflects the content, focusing on the obsolescence of traditional SSL practices. The presentation is well-researched and up-to-date, with a clear structure that enhances credibility. The lack of formal references is a minor weakness, but the speaker’s expertise and the factual accuracy of the content compensate for this.

The title accurately reflects the content, which focuses on how traditional SSL practices are outdated and what has changed in modern TLS.

8/10

The talk is given by an expert in the field, CEO of a certificate automation company, and covers historical and current developments in TLS with accurate technical details. The presentation is well-structured and includes references to real events and standards. Minor inaccuracies in technical explanations (e.g., discrete logarithm vs. Diffie-Hellman problem) are noted but do not significantly detract from overall reliability.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction to the talk and the outdated Stack Overflow command for generating a CSR.
• 05:00Explanation of the original SSL handshake and the role of certificates.
• 10:00Discussion of the CA/Browser Forum and the baseline requirements.
• 15:00The DigiNotar breach and its impact on trust in CAs.
• 20:00Snowden revelations and the introduction of Perfect Forward Secrecy.
• 25:00Explanation of Diffie-Hellman key exchange and the discrete logarithm problem.
• 30:00Certificate Transparency and Google's enforcement.
• 35:00SHA-1 deprecation and the SHAttered collision.
• 40:00Heartbleed and the broken revocation system.
• 45:00The rise of Let's Encrypt and automated certificate management.

• NDC Conferences — Conference website mentioned in the video description.
• NDC Toronto — Conference website mentioned in the video description.

• RFC 6962 - Certificate Transparency — The RFC referenced in the talk for Certificate Transparency.
• Let's Encrypt Statistics — Statistics on Let's Encrypt adoption, supporting the talk's claims about automation.

• Comment on discrete logarithm vs. Diffie-Hellman problem — A commenter pointed out that the talk incorrectly equates the discrete logarithm problem with the Diffie-Hellman problem. The discrete logarithm is about deriving a from g^a mod p, while the Diffie-Hellman problem is about deriving g^ab from g^a and g^b. This is a minor technical inaccuracy.