diff --git a/src/cert/acme1.js b/src/cert/acme1.js
index c8e1b9b1c..572219bbd 100644
--- a/src/cert/acme1.js
+++ b/src/cert/acme1.js
@@ -456,24 +456,26 @@ Acme1.prototype.acmeFlow = function (domain, callback) {
     });
 };
 
-Acme1.prototype.getCertificate = function (domain, callback) {
+Acme1.prototype.getCertificate = function (hostname, domain, callback) {
+    assert.strictEqual(typeof hostname, 'string');
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof callback, 'function');
 
-    debug('getCertificate: start acme flow for %s from %s', domain, this.caOrigin);
-    this.acmeFlow(domain, function (error) {
+    debug('getCertificate: start acme flow for %s from %s', hostname, this.caOrigin);
+    this.acmeFlow(hostname, function (error) {
         if (error) return callback(error);
 
         var outdir = paths.APP_CERTS_DIR;
-        callback(null, path.join(outdir, domain + '.cert'), path.join(outdir, domain + '.key'));
+        callback(null, path.join(outdir, hostname + '.cert'), path.join(outdir, hostname + '.key'));
     });
 };
 
-function getCertificate(domain, options, callback) {
+function getCertificate(hostname, domain, options, callback) {
+    assert.strictEqual(typeof hostname, 'string');
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof options, 'object');
     assert.strictEqual(typeof callback, 'function');
 
     var acme = new Acme1(options || { });
-    acme.getCertificate(domain, callback);
+    acme.getCertificate(hostname, domain, callback);
 }
diff --git a/src/cert/acme2.js b/src/cert/acme2.js
index 5d281172e..613df0a0c 100644
--- a/src/cert/acme2.js
+++ b/src/cert/acme2.js
@@ -477,30 +477,32 @@ Acme2.prototype.getDirectory = function (callback) {
     });
 };
 
-Acme2.prototype.getCertificate = function (domain, callback) {
+Acme2.prototype.getCertificate = function (hostname, domain, callback) {
+    assert.strictEqual(typeof hostname, 'string');
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof callback, 'function');
 
-    debug(`getCertificate: start acme flow for ${domain} from ${this.caDirectory}`);
+    debug(`getCertificate: start acme flow for ${hostname} from ${this.caDirectory}`);
 
     const that = this;
     this.getDirectory(function (error) {
         if (error) return callback(error);
 
-        that.acmeFlow(domain, function (error) {
+        that.acmeFlow(hostname, function (error) {
             if (error) return callback(error);
 
             var outdir = paths.APP_CERTS_DIR;
-            callback(null, path.join(outdir, domain + '.cert'), path.join(outdir, domain + '.key'));
+            callback(null, path.join(outdir, hostname + '.cert'), path.join(outdir, hostname + '.key'));
         });
     });
 };
 
-function getCertificate(domain, options, callback) {
+function getCertificate(hostname, domain, options, callback) {
+    assert.strictEqual(typeof hostname, 'string');
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof options, 'object');
     assert.strictEqual(typeof callback, 'function');
 
     var acme = new Acme2(options || { });
-    acme.getCertificate(domain, callback);
+    acme.getCertificate(hostname, domain, callback);
 }
diff --git a/src/cert/caas.js b/src/cert/caas.js
index 6d867bce5..ebc7aa196 100644
--- a/src/cert/caas.js
+++ b/src/cert/caas.js
@@ -10,12 +10,13 @@ exports = module.exports = {
 var assert = require('assert'),
     debug = require('debug')('box:cert/caas.js');
 
-function getCertificate(vhost, options, callback) {
-    assert.strictEqual(typeof vhost, 'string');
+function getCertificate(hostname, domain, options, callback) {
+    assert.strictEqual(typeof hostname, 'string');
+    assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof options, 'object');
     assert.strictEqual(typeof callback, 'function');
 
-    debug('getCertificate: using fallback certificate', vhost);
+    debug('getCertificate: using fallback certificate', hostname);
 
     return callback(null, '', '');
 }
diff --git a/src/cert/fallback.js b/src/cert/fallback.js
index e74b75441..01e82e395 100644
--- a/src/cert/fallback.js
+++ b/src/cert/fallback.js
@@ -10,12 +10,13 @@ exports = module.exports = {
 var assert = require('assert'),
     debug = require('debug')('box:cert/fallback.js');
 
-function getCertificate(vhost, options, callback) {
-    assert.strictEqual(typeof vhost, 'string');
+function getCertificate(hostname, domain, options, callback) {
+    assert.strictEqual(typeof hostname, 'string');
+    assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof options, 'object');
     assert.strictEqual(typeof callback, 'function');
 
-    debug('getCertificate: using fallback certificate', vhost);
+    debug('getCertificate: using fallback certificate', hostname);
 
     return callback(null, '', '');
 }
diff --git a/src/cert/interface.js b/src/cert/interface.js
index 381a57cdb..4536f789e 100644
--- a/src/cert/interface.js
+++ b/src/cert/interface.js
@@ -12,7 +12,8 @@ exports = module.exports = {
 
 var assert = require('assert');
 
-function getCertificate(domain, options, callback) {
+function getCertificate(hostname, domain, options, callback) {
+    assert.strictEqual(typeof hostname, 'string');
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof options, 'object');
     assert.strictEqual(typeof callback, 'function');
diff --git a/src/reverseproxy.js b/src/reverseproxy.js
index 5c46c99a7..710860347 100644
--- a/src/reverseproxy.js
+++ b/src/reverseproxy.js
@@ -22,7 +22,7 @@ exports = module.exports = {
     removeAppConfigs: removeAppConfigs,
 
     // exported for testing
-    _getApi: getApi
+    _getCertApi: getCertApi
 };
 
 var acme2 = require('./cert/acme2.js'),
@@ -255,7 +255,7 @@ function ensureCertificate(appDomain, auditSource, callback) {
 
         debug('ensureCertificate: getting certificate for %s with options %j', vhost, apiOptions);
 
-        api.getCertificate(vhost, apiOptions, function (error, certFilePath, keyFilePath) {
+        api.getCertificate(vhost, appDomain.domain, apiOptions, function (error, certFilePath, keyFilePath) {
             var errorMessage = error ? error.message : '';
 
             if (error) {
diff --git a/src/test/reverseproxy-test.js b/src/test/reverseproxy-test.js
index 967677e31..9ac8a1d0e 100644
--- a/src/test/reverseproxy-test.js
+++ b/src/test/reverseproxy-test.js
@@ -128,7 +128,7 @@ describe('Certificates', function () {
         after(cleanup);
 
         it('returns prod caas for prod cloudron', function (done) {
-            reverseProxy._getApi(DOMAIN_0.domain, function (error, api, options) {
+            reverseProxy._getCertApi(DOMAIN_0.domain, function (error, api, options) {
                 expect(error).to.be(null);
                 expect(api._name).to.be('caas');
                 expect(options.prod).to.be(true);
@@ -137,7 +137,7 @@ describe('Certificates', function () {
         });
 
         it('returns prod caas for dev cloudron', function (done) {
-            reverseProxy._getApi(DOMAIN_0.domain, function (error, api, options) {
+            reverseProxy._getCertApi(DOMAIN_0.domain, function (error, api, options) {
                 expect(error).to.be(null);
                 expect(api._name).to.be('caas');
                 expect(options.prod).to.be(true);
@@ -159,7 +159,7 @@ describe('Certificates', function () {
         after(cleanup);
 
         it('returns prod acme in prod cloudron', function (done) {
-            reverseProxy._getApi(DOMAIN_0.domain, function (error, api, options) {
+            reverseProxy._getCertApi(DOMAIN_0.domain, function (error, api, options) {
                 expect(error).to.be(null);
                 expect(api._name).to.be('acme');
                 expect(options.prod).to.be(true);
@@ -168,7 +168,7 @@ describe('Certificates', function () {
         });
 
         it('returns prod acme in dev cloudron', function (done) {
-            reverseProxy._getApi(DOMAIN_0.domain, function (error, api, options) {
+            reverseProxy._getCertApi(DOMAIN_0.domain, function (error, api, options) {
                 expect(error).to.be(null);
                 expect(api._name).to.be('acme');
                 expect(options.prod).to.be(true);
@@ -190,7 +190,7 @@ describe('Certificates', function () {
         after(cleanup);
 
         it('returns staging acme in prod cloudron', function (done) {
-            reverseProxy._getApi(DOMAIN_0.domain, function (error, api, options) {
+            reverseProxy._getCertApi(DOMAIN_0.domain, function (error, api, options) {
                 expect(error).to.be(null);
                 expect(api._name).to.be('acme');
                 expect(options.prod).to.be(false);
@@ -199,7 +199,7 @@ describe('Certificates', function () {
         });
 
         it('returns staging acme in dev cloudron', function (done) {
-            reverseProxy._getApi(DOMAIN_0.domain, function (error, api, options) {
+            reverseProxy._getCertApi(DOMAIN_0.domain, function (error, api, options) {
                 expect(error).to.be(null);
                 expect(api._name).to.be('acme');
                 expect(options.prod).to.be(false);