diff --git a/certbot/auth_handler.py b/certbot/auth_handler.py
index e7d658b25..efee49143 100644
--- a/certbot/auth_handler.py
+++ b/certbot/auth_handler.py
@@ -113,6 +113,12 @@ class AuthHandler(object):
                 aauthzr.authzr, path)
             aauthzr.achalls.extend(aauthzr_achalls)
 
+        for aauthzr in aauthzrs:
+            for achall in aauthzr.achalls:
+                if isinstance(achall.chall, challenges.TLSSNI01):
+                    logger.warning("TLS-SNI-01 is deprecated, and will stop working soon.")
+                    return
+
     def _has_challenges(self, aauthzrs):
         """Do we have any challenges to perform?"""
         return any(aauthzr.achalls for aauthzr in aauthzrs)
diff --git a/certbot/tests/auth_handler_test.py b/certbot/tests/auth_handler_test.py
index 76d1df90f..e1319b614 100644
--- a/certbot/tests/auth_handler_test.py
+++ b/certbot/tests/auth_handler_test.py
@@ -327,6 +327,11 @@ class HandleAuthorizationsTest(unittest.TestCase):
                 azr.body.combinations)
             aauthzrs[i] = type(aauthzr)(updated_azr, aauthzr.achalls)
 
+    @mock.patch("certbot.auth_handler.logger")
+    def test_tls_sni_logs(self, logger):
+        self._test_name1_tls_sni_01_1_common(combos=True)
+        self.assertTrue("deprecated" in logger.warning.call_args[0][0])
+
 
 class PollChallengesTest(unittest.TestCase):
     # pylint: disable=protected-access