diff --git a/scripts/cloudron-provision b/scripts/cloudron-provision
index 32239826c..0d6d9aa7e 100755
--- a/scripts/cloudron-provision
+++ b/scripts/cloudron-provision
@@ -66,7 +66,7 @@ wait_for_status "version" '*'
 echo "Provisioning Cloudron ${subdomain}.${zone}"
 setupData=$(printf '{ "dnsConfig": { "domain": "%s", "provider": "cloudflare", "config": { "token": "%s", "email": "%s", "hyphenatedSubdomains": true }, "tlsConfig": { "provider": "fallback" } }, "autoconf": { "appstoreConfig": { "userId": "%s", "token": "%s" } } }' "${subdomain}.${zone}" "${cloudflare_token}" "${cloudflare_email}" "${appstore_id}" "${appstore_token}")
 
-if ! setupResult=$($curl -k -X POST -H "Content-Type: application/json" -d "${setupData}" https://${ip}/api/v1/cloudron/setup); then
+if ! setupResult=$($curl -kq -X POST -H "Content-Type: application/json" -d "${setupData}" https://${ip}/api/v1/cloudron/setup); then
     echo "Failed to setup with ${setupData}: ${setupResult}"
     exit 1
 fi
diff --git a/src/reverseproxy.js b/src/reverseproxy.js
index e0efa5b40..824959705 100644
--- a/src/reverseproxy.js
+++ b/src/reverseproxy.js
@@ -197,15 +197,14 @@ function generateFallbackCertificateSync(domainObject) {
     let opensslConf = safe.fs.readFileSync('/etc/ssl/openssl.cnf', 'utf8');
     // SAN must contain all the domains since CN check is based on implementation if SAN is found. -checkhost also checks only SAN if present!
     let opensslConfWithSan;
-    if (domainObject.config.hyphenatedSubdomains) {
-        let parentDomain = domains.parentDomain(domain);
-        opensslConfWithSan = `${opensslConf}\n[SAN]\nsubjectAltName=DNS:${domain},DNS:*.${parentDomain}\n`;
-    } else {
-        opensslConfWithSan = `${opensslConf}\n[SAN]\nsubjectAltName=DNS:${domain},DNS:*.${domain}\n`;
-    }
+    let cn = domainObject.config.hyphenatedSubdomains ? domains.parentDomain(domain) : domain;
+
+    debug(`generateFallbackCertificateSync: domain=${domainObject.domain} cn=${cn} hyphenated=${domainObject.config.hyphenatedSubdomains}`);
+
+    opensslConfWithSan = `${opensslConf}\n[SAN]\nsubjectAltName=DNS:${domain},DNS:*.${cn}\n`;
     let configFile = path.join(os.tmpdir(), 'openssl-' + crypto.randomBytes(4).readUInt32LE(0) + '.conf');
     safe.fs.writeFileSync(configFile, opensslConfWithSan, 'utf8');
-    let certCommand = util.format(`openssl req -x509 -newkey rsa:2048 -keyout ${keyFilePath} -out ${certFilePath} -days 3650 -subj /CN=*.${domain} -extensions SAN -config ${configFile} -nodes`);
+    let certCommand = util.format(`openssl req -x509 -newkey rsa:2048 -keyout ${keyFilePath} -out ${certFilePath} -days 3650 -subj /CN=*.${cn} -extensions SAN -config ${configFile} -nodes`);
     if (!safe.child_process.execSync(certCommand)) return { error: new ReverseProxyError(ReverseProxyError.INTERNAL_ERROR, safe.error.message) };
     safe.fs.unlinkSync(configFile);
 
@@ -227,9 +226,11 @@ function setFallbackCertificate(domain, fallback, callback) {
     assert.strictEqual(typeof callback, 'function');
 
     if (fallback.restricted) { // restricted certs are not backed up
+        debug(`setFallbackCertificate: setting restricted certs for domain ${domain}`);
         if (!safe.fs.writeFileSync(path.join(paths.NGINX_CERT_DIR, `${domain}.host.cert`), fallback.cert)) return callback(new ReverseProxyError(ReverseProxyError.INTERNAL_ERROR, safe.error.message));
         if (!safe.fs.writeFileSync(path.join(paths.NGINX_CERT_DIR, `${domain}.host.key`), fallback.key)) return callback(new ReverseProxyError(ReverseProxyError.INTERNAL_ERROR, safe.error.message));
     } else {
+        debug(`setFallbackCertificate: setting certs for domain ${domain}`);
         if (!safe.fs.writeFileSync(path.join(paths.APP_CERTS_DIR, `${domain}.host.cert`), fallback.cert)) return callback(new ReverseProxyError(ReverseProxyError.INTERNAL_ERROR, safe.error.message));
         if (!safe.fs.writeFileSync(path.join(paths.APP_CERTS_DIR, `${domain}.host.key`), fallback.key)) return callback(new ReverseProxyError(ReverseProxyError.INTERNAL_ERROR, safe.error.message));
     }