Apple, Google, Microsoft, and Mozilla have announced a unified plan to deprecate the use of TLS 1.0 and 1.1 in their web browsers in early 2020
Almost everyone has now migrated to TLS 1.2, and a few have moved to TLS 1.3. — Apple, Google, Microsoft, and Mozilla have announced …
Context & Ripple Effects
This announcement extends a coordination habit the four browser makers have been building since 2015, when they jointly dropped RC4 from Chrome, Edge, IE, and Firefox. The playbook repeated with Google's plan to distrust Symantec certificates and again in August 2018, when Chrome and Firefox shipped support for TLS 1.3 days after the IETF finalized it.
What makes this move different is scope: rather than removing one broken cipher, all four vendors are retiring two entire protocol versions at once. The precedent for collateral damage exists — the earlier SHA-2 transition stranded tens of millions of users on older browsers and devices unable to reach HTTPS sites.
First-order effects
- Site operators still serving TLS 1.0 or 1.1 have until early 2020 to migrate to TLS 1.2 or newer before Chrome, Firefox, Edge, and Safari break or warn on their pages.
- Users on legacy platforms that cannot negotiate TLS 1.2 — the same population stranded by the SHA-2 cutover — face losing access to sites they currently reach.
Second-order effects
- Certificate authorities, CDNs, and hosting providers inherit a hard deadline wave, since most laggard sites will need new certificates and server configuration, not just a settings toggle.
- The four vendors' synchronized timeline removes the usual arbitrage of users switching browsers to keep visiting outdated sites, so no operator can shop around for a lenient client.
Third-order effects
- Coordinated deprecation establishes the browser bloc as the effective enforcement arm for web security policy — a structure later visible when Apple's 398-day certificate lifespan limit was copied by Chrome and Firefox over CAs' objections.
- If the pattern holds, protocol and certificate lifecycles get set by vendor consensus announced jointly, compressing the window between IETF standardization and forced migration for the whole web.
The trend: Browser vendors are consolidating into a unified standards-enforcement bloc that sets deprecation deadlines for the entire web, ahead of formal standards bodies.