diff --git a/lib/puppet/ssl/validator.rb b/lib/puppet/ssl/validator.rb
index <HASH>..<HASH> 100644
--- a/lib/puppet/ssl/validator.rb
+++ b/lib/puppet/ssl/validator.rb
@@ -24,6 +24,7 @@ class Puppet::SSL::Validator
   # @api public
   #
   def self.default_validator()
+    Puppet.deprecation_warning("Puppet::SSL::Validator.default_validator is deprecated. Use Puppet::SSL::Validator.cert_auth_validator if the host has a signed cert, or Puppet::SSL::Validator.best_validator if the host certificate signing status is unknown.")
     best_validator
   end
(PUP-<I>) Deprecate Validator.default_validator

The `.default_validator` factory method is no longer needed nor desirable
since the DefaultValidator class has been dismantled and simply
delegates to `.best_validator` under the hood. The method now logs a
warning telling API consumers of the current best practices, but calls
`.best_validator` for backwards compatibility.