diff --git a/src/directoryserver.js b/src/directoryserver.js
index 8fd960677..9317afb17 100644
--- a/src/directoryserver.js
+++ b/src/directoryserver.js
@@ -368,7 +368,7 @@ async function stop() {
 
 async function handleCertChanged() {
     const certificate = await reverseProxy.getDirectoryServerCertificate();
-    if (certificate.cert.equals(gCertificate.cert)) {
+    if (certificate.cert === gCertificate.cert) {
         debug('handleCertChanged: certificate has not changed');
         return;
     }
diff --git a/src/mail.js b/src/mail.js
index 8a384ae2d..fcf21e0f4 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -813,7 +813,7 @@ async function restartMailIfActivated() {
 async function handleCertChanged() {
     debug('handleCertChanged: will restart if activated');
     const certificate = await reverseProxy.getMailCertificate();
-    const cert = safe.fs.readFileSync(`${paths.MAIL_CONFIG_DIR}/tls_cert.pem`);
+    const cert = safe.fs.readFileSync(`${paths.MAIL_CONFIG_DIR}/tls_cert.pem`, { encoding: 'utf8' });
     if (cert === certificate.cert) {
         debug('handleCertChanged: certificate has not changed');
         return;
@@ -1009,6 +1009,7 @@ async function onDomainAdded(domain) {
 
     if (!settings.mailFqdn()) return; // mail domain is not set yet (when provisioning)
 
+    debug('onDomainAdded: configuring mail for added domain');
     await upsertDnsRecords(domain, settings.mailFqdn());
     await restartMailIfActivated();
 }
@@ -1016,6 +1017,7 @@ async function onDomainAdded(domain) {
 async function onDomainRemoved(domain) {
     assert.strictEqual(typeof domain, 'string');
 
+    debug('onDomainRemoved: configuring mail for removed domain');
     await restartMail();
 }