diff --git a/npm-shrinkwrap.json b/npm-shrinkwrap.json
index 3a3dd2d01..a641d22b7 100644
--- a/npm-shrinkwrap.json
+++ b/npm-shrinkwrap.json
@@ -2471,6 +2471,11 @@
       "from": "https://registry.npmjs.org/tail-stream/-/tail-stream-0.2.1.tgz",
       "resolved": "https://registry.npmjs.org/tail-stream/-/tail-stream-0.2.1.tgz"
     },
+    "tldjs": {
+      "version": "1.6.2",
+      "from": "tldjs@*",
+      "resolved": "https://registry.npmjs.org/tldjs/-/tldjs-1.6.2.tgz"
+    },
     "underscore": {
       "version": "1.8.3",
       "from": "underscore@>=1.7.0 <2.0.0",
diff --git a/package.json b/package.json
index 60fa9c75a..6149d0cbe 100644
--- a/package.json
+++ b/package.json
@@ -62,6 +62,7 @@
     "superagent": "^1.5.0",
     "supererror": "^0.7.1",
     "tail-stream": "https://registry.npmjs.org/tail-stream/-/tail-stream-0.2.1.tgz",
+    "tldjs": "^1.6.2",
     "underscore": "^1.7.0",
     "ursa": "^0.9.1",
     "valid-url": "^1.0.9",
diff --git a/src/certificates.js b/src/certificates.js
index 3eca92c50..cca36d9b4 100644
--- a/src/certificates.js
+++ b/src/certificates.js
@@ -17,6 +17,7 @@ var acme = require('./cert/acme.js'),
     safe = require('safetydance'),
     settings = require('./settings.js'),
     sysinfo = require('./sysinfo.js'),
+    tld = require('tldjs'),
     user = require('./user.js'),
     util = require('util'),
     waitForDns = require('./waitfordns.js'),
@@ -88,7 +89,8 @@ function installAdminCertificate(callback) {
         sysinfo.getIp(function (error, ip) {
             if (error) return callback(error);
 
-            waitForDns(config.adminFqdn(), ip, config.fqdn(), function (error) {
+            var zoneName = tld.getDomain(config.fqdn());
+            waitForDns(config.adminFqdn(), ip, zoneName, function (error) {
                 if (error) return callback(error); // this cannot happen because we retry forever
 
                 ensureCertificate(config.adminFqdn(), function (error, certFilePath, keyFilePath) {