diff --git a/src/addons.js b/src/addons.js
index e9709e67c..4624e7c28 100644
--- a/src/addons.js
+++ b/src/addons.js
@@ -112,10 +112,9 @@ var KNOWN_ADDONS = {
 var RMAPPDIR_CMD = path.join(__dirname, 'scripts/rmappdir.sh');
 
 function debugApp(app, args) {
-    assert(!app || typeof app === 'object');
+    assert(typeof app === 'object');
 
-    var prefix = app ? app.intrinsicFqdn : '(no app)';
-    debug(prefix + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
+    debug(app.fqdn + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
 }
 
 function setupAddons(app, addons, callback) {
@@ -250,7 +249,7 @@ function setupOauth(app, options, callback) {
     if (!app.sso) return callback(null);
 
     var appId = app.id;
-    var redirectURI = 'https://' + app.intrinsicFqdn;
+    var redirectURI = 'https://' + app.fqdn;
     var scope = 'profile';
 
     clients.delByAppIdAndType(appId, clients.TYPE_OAUTH, function (error) { // remove existing creds
@@ -460,6 +459,10 @@ function teardownMySql(app, options, callback) {
 }
 
 function backupMySql(app, options, callback) {
+    assert.strictEqual(typeof app, 'object');
+    assert.strictEqual(typeof options, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
     debugApp(app, 'Backing up mysql');
 
     callback = once(callback); // ChildProcess exit may or may not be called after error
@@ -473,6 +476,10 @@ function backupMySql(app, options, callback) {
 }
 
 function restoreMySql(app, options, callback) {
+    assert.strictEqual(typeof app, 'object');
+    assert.strictEqual(typeof options, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
     callback = once(callback); // ChildProcess exit may or may not be called after error
 
     setupMySql(app, options, function (error) {
@@ -525,6 +532,10 @@ function teardownPostgreSql(app, options, callback) {
 }
 
 function backupPostgreSql(app, options, callback) {
+    assert.strictEqual(typeof app, 'object');
+    assert.strictEqual(typeof options, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
     debugApp(app, 'Backing up postgresql');
 
     callback = once(callback); // ChildProcess exit may or may not be called after error
@@ -538,6 +549,10 @@ function backupPostgreSql(app, options, callback) {
 }
 
 function restorePostgreSql(app, options, callback) {
+    assert.strictEqual(typeof app, 'object');
+    assert.strictEqual(typeof options, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
     callback = once(callback);
 
     setupPostgreSql(app, options, function (error) {
@@ -591,6 +606,10 @@ function teardownMongoDb(app, options, callback) {
 }
 
 function backupMongoDb(app, options, callback) {
+    assert.strictEqual(typeof app, 'object');
+    assert.strictEqual(typeof options, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
     debugApp(app, 'Backing up mongodb');
 
     callback = once(callback); // ChildProcess exit may or may not be called after error
@@ -604,6 +623,10 @@ function backupMongoDb(app, options, callback) {
 }
 
 function restoreMongoDb(app, options, callback) {
+    assert.strictEqual(typeof app, 'object');
+    assert.strictEqual(typeof options, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
     callback = once(callback); // ChildProcess exit may or may not be called after error
 
     setupMongoDb(app, options, function (error) {
@@ -647,7 +670,7 @@ function setupRedis(app, options, callback) {
     }
 
     const tag = infra.images.redis.tag, redisName = 'redis-' + app.id;
-    const label = app.intrinsicFqdn;
+    const label = app.fqdn;
     // note that we do not add appId label because this interferes with the stop/start app logic
     const cmd = `docker run --restart=always -d --name=${redisName} \
                 --label=location=${label} \
@@ -706,6 +729,10 @@ function teardownRedis(app, options, callback) {
 }
 
 function backupRedis(app, options, callback) {
+    assert.strictEqual(typeof app, 'object');
+    assert.strictEqual(typeof options, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
     debugApp(app, 'Backing up redis');
 
     var cmd = [ '/addons/redis/service.sh', 'backup' ]; // the redis dir is volume mounted
diff --git a/src/apphealthmonitor.js b/src/apphealthmonitor.js
index 52ee1dfe1..fb7c0987d 100644
--- a/src/apphealthmonitor.js
+++ b/src/apphealthmonitor.js
@@ -23,13 +23,9 @@ var gRunTimeout = null;
 var gDockerEventStream = null;
 
 function debugApp(app) {
-    assert(!app || typeof app === 'object');
+    assert(typeof app === 'object');
 
-    var prefix = app ? app.intrinsicFqdn : '(no app)';
-    var manifestAppId = app ? app.manifest.id : '';
-    var id = app ? app.id : '';
-
-    debug(prefix + ' ' + manifestAppId + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)) + ' - ' + id);
+    debug(app.fqdn + ' ' + app.manifest.id + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)) + ' - ' + app.id);
 }
 
 function setHealth(app, health, callback) {
@@ -70,6 +66,9 @@ function setHealth(app, health, callback) {
 
 // callback is called with error for fatal errors and not if health check failed
 function checkAppHealth(app, callback) {
+    assert.strictEqual(typeof app, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
     if (app.installationState !== appdb.ISTATE_INSTALLED || app.runState !== appdb.RSTATE_RUNNING) {
         debugApp(app, 'skipped. istate:%s rstate:%s', app.installationState, app.runState);
         return callback(null);
diff --git a/src/apps.js b/src/apps.js
index 4481504ec..91e83b38b 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -311,7 +311,7 @@ function getAppConfig(app) {
         manifest: app.manifest,
         location: app.location,
         domain: app.domain,
-        intrinsicFqdn: app.intrinsicFqdn,
+        fqdn: app.fqdn,
         accessRestriction: app.accessRestriction,
         portBindings: app.portBindings,
         memoryLimit: app.memoryLimit,
@@ -361,9 +361,8 @@ function get(appId, callback) {
         domaindb.get(app.domain, function (error, result) {
             if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
 
-            app.intrinsicFqdn = domains.fqdn(app.location, app.domain, result.provider);
             app.iconUrl = getIconUrlSync(app);
-            app.fqdn = app.intrinsicFqdn;
+            app.fqdn = domains.fqdn(app.location, app.domain, result.provider);
 
             callback(null, app);
         });
@@ -384,9 +383,8 @@ function getByIpAddress(ip, callback) {
             domaindb.get(app.domain, function (error, result) {
                 if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
 
-                app.intrinsicFqdn = domains.fqdn(app.location, app.domain, result.provider);
                 app.iconUrl = getIconUrlSync(app);
-                app.fqdn = app.intrinsicFqdn;
+                app.fqdn = domains.fqdn(app.location, app.domain, result.provider);
 
                 callback(null, app);
             });
@@ -404,9 +402,8 @@ function getAll(callback) {
             domaindb.get(app.domain, function (error, result) {
                 if (error) return iteratorDone(new AppsError(AppsError.INTERNAL_ERROR, error));
 
-                app.intrinsicFqdn = domains.fqdn(app.location, app.domain, result.provider);
                 app.iconUrl = getIconUrlSync(app);
-                app.fqdn = app.intrinsicFqdn;
+                app.fqdn = domains.fqdn(app.location, app.domain, result.provider);
 
                 iteratorDone();
             });
@@ -522,13 +519,13 @@ function install(data, auditSource, callback) {
             if (error && error.reason === DomainError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, 'No such domain'));
             if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Could not get domain info:' + error.message));
 
-            var intrinsicFqdn = domains.fqdn(location, domain, domainObject.provider);
+            var fqdn = domains.fqdn(location, domain, domainObject.provider);
 
-            error = validateHostname(location, domain, intrinsicFqdn);
+            error = validateHostname(location, domain, fqdn);
             if (error) return callback(error);
 
             if (cert && key) {
-                error = reverseProxy.validateCertificate(intrinsicFqdn, cert, key);
+                error = reverseProxy.validateCertificate(fqdn, cert, key);
                 if (error) return callback(new AppsError(AppsError.BAD_CERTIFICATE, error.message));
             }
 
@@ -549,8 +546,7 @@ function install(data, auditSource, callback) {
                     mailboxName: (location ? location : manifest.title.toLowerCase().replace(/[^a-zA-Z0-9]/g, '')) + '.app',
                     restoreConfig: backupId ? { backupId: backupId, backupFormat: backupFormat } : null,
                     enableBackup: enableBackup,
-                    robotsTxt: robotsTxt,
-                    intrinsicFqdn: intrinsicFqdn
+                    robotsTxt: robotsTxt
                 };
 
                 appdb.add(appId, appStoreId, manifest, location, domain, portBindings, data, function (error) {
@@ -559,8 +555,8 @@ function install(data, auditSource, callback) {
 
                     // save cert to boxdata/certs
                     if (cert && key) {
-                        if (!safe.fs.writeFileSync(path.join(paths.APP_CERTS_DIR, intrinsicFqdn + '.user.cert'), cert)) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Error saving cert: ' + safe.error.message));
-                        if (!safe.fs.writeFileSync(path.join(paths.APP_CERTS_DIR, intrinsicFqdn + '.user.key'), key)) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Error saving key: ' + safe.error.message));
+                        if (!safe.fs.writeFileSync(path.join(paths.APP_CERTS_DIR, fqdn + '.user.cert'), cert)) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Error saving cert: ' + safe.error.message));
+                        if (!safe.fs.writeFileSync(path.join(paths.APP_CERTS_DIR, fqdn + '.user.key'), key)) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Error saving key: ' + safe.error.message));
                     }
 
                     taskmanager.restartAppTask(appId);
@@ -633,24 +629,22 @@ function configure(appId, data, auditSource, callback) {
             if (error && error.reason === DomainError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, 'No such domain'));
             if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Could not get domain info:' + error.message));
 
-            var intrinsicFqdn = domains.fqdn(location, domain, domainObject.provider);
+            var fqdn = domains.fqdn(location, domain, domainObject.provider);
 
-            error = validateHostname(location, domain, intrinsicFqdn);
+            error = validateHostname(location, domain, fqdn);
             if (error) return callback(error);
 
             // save cert to boxdata/certs. TODO: move this to apptask when we have a real task queue
             if ('cert' in data && 'key' in data) {
-                var vhost = intrinsicFqdn;
-
                 if (data.cert && data.key) {
-                    error = reverseProxy.validateCertificate(vhost, data.cert, data.key);
+                    error = reverseProxy.validateCertificate(fqdn, data.cert, data.key);
                     if (error) return callback(new AppsError(AppsError.BAD_CERTIFICATE, error.message));
 
-                    if (!safe.fs.writeFileSync(path.join(paths.APP_CERTS_DIR, `${vhost}.user.cert`), data.cert)) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Error saving cert: ' + safe.error.message));
-                    if (!safe.fs.writeFileSync(path.join(paths.APP_CERTS_DIR, `${vhost}.user.key`), data.key)) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Error saving key: ' + safe.error.message));
+                    if (!safe.fs.writeFileSync(path.join(paths.APP_CERTS_DIR, `${fqdn}.user.cert`), data.cert)) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Error saving cert: ' + safe.error.message));
+                    if (!safe.fs.writeFileSync(path.join(paths.APP_CERTS_DIR, `${fqdn}.user.key`), data.key)) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Error saving key: ' + safe.error.message));
                 } else { // remove existing cert/key
-                    if (!safe.fs.unlinkSync(path.join(paths.APP_CERTS_DIR, `${vhost}.user.cert`))) debug('Error removing cert: ' + safe.error.message);
-                    if (!safe.fs.unlinkSync(path.join(paths.APP_CERTS_DIR, `${vhost}..user.key`))) debug('Error removing key: ' + safe.error.message);
+                    if (!safe.fs.unlinkSync(path.join(paths.APP_CERTS_DIR, `${fqdn}.user.cert`))) debug('Error removing cert: ' + safe.error.message);
+                    if (!safe.fs.unlinkSync(path.join(paths.APP_CERTS_DIR, `${fqdn}..user.key`))) debug('Error removing key: ' + safe.error.message);
                 }
             }
 
@@ -893,9 +887,7 @@ function clone(appId, data, auditSource, callback) {
                 if (error && error.reason === DomainError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, 'No such domain'));
                 if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Could not get domain info:' + error.message));
 
-                var intrinsicFqdn = domains.fqdn(location, domain, domainObject.provider);
-
-                error = validateHostname(location, domain, intrinsicFqdn);
+                error = validateHostname(location, domain, domains.fqdn(location, domain, domainObject.provider));
                 if (error) return callback(error);
 
                 var newAppId = uuid.v4(), manifest = backupInfo.manifest;
@@ -1163,13 +1155,13 @@ function restoreInstalledApps(callback) {
         if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
 
         async.map(apps, function (app, iteratorDone) {
-            debug('marking %s for restore', app.intrinsicFqdn);
+            debug('marking %s for restore', app.fqdn);
 
             backups.getByAppIdPaged(1, 1, app.id, function (error, results) {
                 var restoreConfig = !error && results.length ? { backupId: results[0].id, backupFormat: results[0].format } : null;
 
                 appdb.setInstallationCommand(app.id, appdb.ISTATE_PENDING_RESTORE, { restoreConfig: restoreConfig, oldConfig: null }, function (error) {
-                    if (error) debug('did not mark %s for restore', app.intrinsicFqdn, error);
+                    if (error) debug('did not mark %s for restore', app.fqdn, error);
 
                     iteratorDone(); // always succeed
                 });
@@ -1185,10 +1177,10 @@ function configureInstalledApps(callback) {
         if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
 
         async.map(apps, function (app, iteratorDone) {
-            debug('marking %s for reconfigure', app.intrinsicFqdn);
+            debug('marking %s for reconfigure', app.fqdn);
 
             appdb.setInstallationCommand(app.id, appdb.ISTATE_PENDING_CONFIGURE, { oldConfig: null }, function (error) {
-                if (error) debug('did not mark %s for reconfigure', app.intrinsicFqdn, error);
+                if (error) debug('did not mark %s for reconfigure', app.fqdn, error);
 
                 iteratorDone(); // always succeed
             });
diff --git a/src/apptask.js b/src/apptask.js
index c57ba5d2c..da445a240 100644
--- a/src/apptask.js
+++ b/src/apptask.js
@@ -70,8 +70,7 @@ function initialize(callback) {
 function debugApp(app) {
     assert.strictEqual(typeof app, 'object');
 
-    var prefix = app ? (app.intrinsicFqdn || '(bare)') : '(no app)';
-    debug(prefix + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
+    debug(app.fqdn + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
 }
 
 // updates the app object and the database
@@ -265,7 +264,7 @@ function registerSubdomain(app, overwrite, callback) {
         if (error) return callback(error);
 
         async.retry({ times: 200, interval: 5000 }, function (retryCallback) {
-            debugApp(app, 'Registering subdomain location [%s] overwrite: %s', app.intrinsicFqdn, overwrite);
+            debugApp(app, 'Registering subdomain location [%s] overwrite: %s', app.fqdn, overwrite);
 
             // get the current record before updating it
             domains.getDNSRecords(app.location, app.domain, 'A', function (error, values) {
@@ -304,7 +303,7 @@ function unregisterSubdomain(app, location, domain, callback) {
         if (error) return callback(error);
 
         async.retry({ times: 30, interval: 5000 }, function (retryCallback) {
-            debugApp(app, 'Unregistering subdomain: %s', app.intrinsicFqdn);
+            debugApp(app, 'Unregistering subdomain: %s', app.fqdn);
 
             domains.removeDNSRecords(location, domain, 'A', [ ip ], function (error) {
                 if (error && error.reason === DomainError.NOT_FOUND) return retryCallback(null, null); // domain can be not found if oldConfig.domain or restoreConfig.domain was removed
@@ -342,7 +341,7 @@ function waitForDnsPropagation(app, callback) {
     sysinfo.getPublicIp(function (error, ip) {
         if (error) return callback(error);
 
-        domains.waitForDNSRecord(app.intrinsicFqdn, app.domain, ip, 'A', { interval: 5000, times: 120 }, callback);
+        domains.waitForDNSRecord(app.fqdn, app.domain, ip, 'A', { interval: 5000, times: 120 }, callback);
     });
 }
 
@@ -473,7 +472,7 @@ function configure(app, callback) {
     assert.strictEqual(typeof callback, 'function');
 
     // oldConfig can be null during an infra update
-    var locationChanged = app.oldConfig && (app.oldConfig.intrinsicFqdn !== app.intrinsicFqdn);
+    var locationChanged = app.oldConfig && (app.oldConfig.fqdn !== app.fqdn);
 
     async.series([
         updateApp.bind(null, app, { installationProgress: '10, Cleaning up old install' }),
diff --git a/src/backups.js b/src/backups.js
index 6d9f037bb..b368d72cc 100644
--- a/src/backups.js
+++ b/src/backups.js
@@ -68,10 +68,9 @@ var NOOP_CALLBACK = function (error) { if (error) debug(error); };
 var BACKUPTASK_CMD = path.join(__dirname, 'backuptask.js');
 
 function debugApp(app) {
-    assert(!app || typeof app === 'object');
+    assert(typeof app === 'object');
 
-    var prefix = app ? app.intrinsicFqdn : '(no app)';
-    debug(prefix + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
+    debug(app.fqdn + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
 }
 
 function BackupsError(reason, errorOrMessage) {
@@ -720,7 +719,7 @@ function backupApp(app, callback) {
     const timestamp = (new Date()).toISOString().replace(/[T.]/g, '-').replace(/[:Z]/g,'');
     safe.fs.unlinkSync(paths.BACKUP_LOG_FILE); // start fresh log file
 
-    progress.set(progress.BACKUP, 10,  'Backing up ' + app.intrinsicFqdn);
+    progress.set(progress.BACKUP, 10,  'Backing up ' + app.fqdn);
 
     backupAppWithTimestamp(app, timestamp, function (error) {
         progress.set(progress.BACKUP, 100, error ? error.message : '');
@@ -747,12 +746,12 @@ function backupBoxAndApps(auditSource, callback) {
         var step = 100/(allApps.length+2);
 
         async.mapSeries(allApps, function iterator(app, iteratorCallback) {
-            progress.set(progress.BACKUP, step * processed,  'Backing up ' + app.intrinsicFqdn);
+            progress.set(progress.BACKUP, step * processed,  'Backing up ' + app.fqdn);
 
             ++processed;
 
             if (!app.enableBackup) {
-                progress.set(progress.BACKUP, step * processed, 'Skipped backup ' + app.intrinsicFqdn);
+                progress.set(progress.BACKUP, step * processed, 'Skipped backup ' + app.fqdn);
                 return iteratorCallback(null, null); // nothing to backup
             }
 
@@ -762,7 +761,7 @@ function backupBoxAndApps(auditSource, callback) {
                     return iteratorCallback(error);
                 }
 
-                progress.set(progress.BACKUP, step * processed, 'Backed up ' + app.intrinsicFqdn);
+                progress.set(progress.BACKUP, step * processed, 'Backed up ' + app.fqdn);
 
                 iteratorCallback(null, backupId || null); // clear backupId if is in BAD_STATE and never backed up
             });
diff --git a/src/clients.js b/src/clients.js
index 102efc250..2e3352e66 100644
--- a/src/clients.js
+++ b/src/clients.js
@@ -191,7 +191,7 @@ function getAll(callback) {
                 if (record.type === exports.TYPE_PROXY) record.name = result.manifest.title + ' Website Proxy';
                 if (record.type === exports.TYPE_OAUTH) record.name = result.manifest.title + ' OAuth';
 
-                record.domain = result.intrinsicFqdn;
+                record.domain = result.fqdn;
 
                 tmp.push(record);
 
diff --git a/src/docker.js b/src/docker.js
index 1e8dcbed4..c95c88e1a 100644
--- a/src/docker.js
+++ b/src/docker.js
@@ -49,10 +49,9 @@ var addons = require('./addons.js'),
     _ = require('underscore');
 
 function debugApp(app, args) {
-    assert(!app || typeof app === 'object');
+    assert(typeof app === 'object');
 
-    var prefix = app ? app.intrinsicFqdn : '(no app)';
-    debug(prefix + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
+    debug(app.fqdn + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
 }
 
 function pullImage(manifest, callback) {
@@ -129,7 +128,7 @@ function createSubcontainer(app, name, cmd, options, callback) {
 
     var manifest = app.manifest;
     var exposedPorts = {}, dockerPortBindings = { };
-    var domain = app.intrinsicFqdn;
+    var domain = app.fqdn;
     var stdEnv = [
         'CLOUDRON=1',
         'WEBADMIN_ORIGIN=' + config.adminOrigin(),
@@ -186,7 +185,7 @@ function createSubcontainer(app, name, cmd, options, callback) {
                 '/run': {}
             },
             Labels: {
-                'fqdn': app.intrinsicFqdn,
+                'fqdn': app.fqdn,
                 'appId': app.id,
                 'isSubcontainer': String(!isAppContainer)
             },
diff --git a/src/mail.js b/src/mail.js
index 3df6a519f..2fa1de3fa 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -538,7 +538,7 @@ function restartMail(callback) {
     const memoryLimit = Math.max((1 + Math.round(os.totalmem()/(1024*1024*1024)/4)) * 128, 256);
 
     // admin and mail share the same certificate
-    reverseProxy.getCertificate({ intrinsicFqdn: config.adminFqdn(), domain: config.adminDomain() }, function (error, bundle) {
+    reverseProxy.getCertificate({ fqdn: config.adminFqdn(), domain: config.adminDomain() }, function (error, bundle) {
         if (error) return callback(error);
 
         // the setup script copies dhparams.pem to /addons/mail
diff --git a/src/reverseproxy.js b/src/reverseproxy.js
index ce085b81a..185d420ef 100644
--- a/src/reverseproxy.js
+++ b/src/reverseproxy.js
@@ -219,15 +219,13 @@ function getCertificate(app, callback) {
     assert.strictEqual(typeof app, 'object');
     assert.strictEqual(typeof callback, 'function');
 
-    var vhost = app.intrinsicFqdn;
-
-    var certFilePath = path.join(paths.APP_CERTS_DIR, `${vhost}.user.cert`);
-    var keyFilePath = path.join(paths.APP_CERTS_DIR, `${vhost}.user.key`);
+    var certFilePath = path.join(paths.APP_CERTS_DIR, `${app.fqdn}.user.cert`);
+    var keyFilePath = path.join(paths.APP_CERTS_DIR, `${app.fqdn}.user.key`);
 
     if (fs.existsSync(certFilePath) && fs.existsSync(keyFilePath)) return callback(null, { certFilePath, keyFilePath });
 
-    certFilePath = path.join(paths.APP_CERTS_DIR, `${vhost}.cert`);
-    keyFilePath = path.join(paths.APP_CERTS_DIR, `${vhost}.key`);
+    certFilePath = path.join(paths.APP_CERTS_DIR, `${app.fqdn}.cert`);
+    keyFilePath = path.join(paths.APP_CERTS_DIR, `${app.fqdn}.key`);
 
     if (fs.existsSync(certFilePath) && fs.existsSync(keyFilePath)) return callback(null, { certFilePath, keyFilePath });
 
@@ -239,26 +237,24 @@ function ensureCertificate(app, auditSource, callback) {
     assert.strictEqual(typeof auditSource, 'object');
     assert.strictEqual(typeof callback, 'function');
 
-    var vhost = app.intrinsicFqdn;
-
-    var certFilePath = path.join(paths.APP_CERTS_DIR, `${vhost}.user.cert`);
-    var keyFilePath = path.join(paths.APP_CERTS_DIR, `${vhost}.user.key`);
+    var certFilePath = path.join(paths.APP_CERTS_DIR, `${app.fqdn}.user.cert`);
+    var keyFilePath = path.join(paths.APP_CERTS_DIR, `${app.fqdn}.user.key`);
 
     if (fs.existsSync(certFilePath) && fs.existsSync(keyFilePath)) {
-        debug('ensureCertificate: %s. user certificate already exists at %s', vhost, keyFilePath);
+        debug('ensureCertificate: %s. user certificate already exists at %s', app.fqdn, keyFilePath);
         return callback(null, { certFilePath, keyFilePath, reason: 'user' });
     }
 
-    certFilePath = path.join(paths.APP_CERTS_DIR, `${vhost}.cert`);
-    keyFilePath = path.join(paths.APP_CERTS_DIR, `${vhost}.key`);
+    certFilePath = path.join(paths.APP_CERTS_DIR, `${app.fqdn}.cert`);
+    keyFilePath = path.join(paths.APP_CERTS_DIR, `${app.fqdn}.key`);
 
     if (fs.existsSync(certFilePath) && fs.existsSync(keyFilePath)) {
-        debug('ensureCertificate: %s. certificate already exists at %s', vhost, keyFilePath);
+        debug('ensureCertificate: %s. certificate already exists at %s', app.fqdn, keyFilePath);
 
         if (!isExpiringSync(certFilePath, 24 * 30)) return callback(null, { certFilePath, keyFilePath, reason: 'existing-le' });
-        debug('ensureCertificate: %s cert require renewal', vhost);
+        debug('ensureCertificate: %s cert require renewal', app.fqdn);
     } else {
-        debug('ensureCertificate: %s cert does not exist', vhost);
+        debug('ensureCertificate: %s cert does not exist', app.fqdn);
     }
 
     getApi(app, function (error, api, apiOptions) {
@@ -313,7 +309,7 @@ function configureAdmin(auditSource, callback) {
     assert.strictEqual(typeof auditSource, 'object');
     assert.strictEqual(typeof callback, 'function');
 
-    var adminApp = { domain: config.adminDomain(), intrinsicFqdn: config.adminFqdn() };
+    var adminApp = { domain: config.adminDomain(), fqdn: config.adminFqdn() };
     ensureCertificate(adminApp, auditSource, function (error, bundle) {
         if (error) return callback(error);
 
@@ -328,12 +324,11 @@ function configureAppInternal(app, bundle, callback) {
 
     var sourceDir = path.resolve(__dirname, '..');
     var endpoint = 'app';
-    var vhost = app.intrinsicFqdn;
 
     var data = {
         sourceDir: sourceDir,
         adminOrigin: config.adminOrigin(),
-        vhost: vhost,
+        vhost: app.fqdn,
         hasIPv6: config.hasIPv6(),
         port: app.httpPort,
         endpoint: endpoint,
@@ -345,10 +340,10 @@ function configureAppInternal(app, bundle, callback) {
     var nginxConf = ejs.render(NGINX_APPCONFIG_EJS, data);
 
     var nginxConfigFilename = path.join(paths.NGINX_APPCONFIG_DIR, app.id + '.conf');
-    debug('writing config for "%s" to %s with options %j', vhost, nginxConfigFilename, data);
+    debug('writing config for "%s" to %s with options %j', app.fqdn, nginxConfigFilename, data);
 
     if (!safe.fs.writeFileSync(nginxConfigFilename, nginxConf)) {
-        debug('Error creating nginx config for "%s" : %s', vhost, safe.error.message);
+        debug('Error creating nginx config for "%s" : %s', app.fqdn, safe.error.message);
         return callback(safe.error);
     }
 
@@ -371,11 +366,9 @@ function unconfigureApp(app, callback) {
     assert.strictEqual(typeof app, 'object');
     assert.strictEqual(typeof callback, 'function');
 
-    var vhost = app.intrinsicFqdn;
-
     var nginxConfigFilename = path.join(paths.NGINX_APPCONFIG_DIR, app.id + '.conf');
     if (!safe.fs.unlinkSync(nginxConfigFilename)) {
-        if (safe.error.code !== 'ENOENT') debug('Error removing nginx configuration of "%s": %s', vhost, safe.error.message);
+        if (safe.error.code !== 'ENOENT') debug('Error removing nginx configuration of "%s": %s', app.fqdn, safe.error.message);
         return callback(null);
     }
 
@@ -391,21 +384,21 @@ function renewAll(auditSource, callback) {
     apps.getAll(function (error, allApps) {
         if (error) return callback(error);
 
-        allApps.push({ domain: config.adminDomain(), intrinsicFqdn: config.adminFqdn() }); // inject fake webadmin app
+        allApps.push({ domain: config.adminDomain(), fqdn: config.adminFqdn() }); // inject fake webadmin app
 
         async.eachSeries(allApps, function (app, iteratorCallback) {
             ensureCertificate(app, auditSource, function (error, bundle) {
                 if (bundle.reason !== 'new-le' && bundle.reason !== 'fallback') return iteratorCallback();
 
                 // reconfigure for the case where we got a renewed cert after fallback
-                var configureFunc = app.intrinsicFqdn === config.adminFqdn() ?
+                var configureFunc = app.fqdn === config.adminFqdn() ?
                     configureAdminInternal.bind(null, bundle, constants.NGINX_ADMIN_CONFIG_FILE_NAME, config.adminFqdn())
                     : configureAppInternal.bind(null, app, bundle);
 
                 configureFunc(function (ignoredError) {
                     if (ignoredError) debug('fallbackExpiredCertificates: error reconfiguring app', ignoredError);
 
-                    platform.handleCertChanged(app.intrinsicFqdn);
+                    platform.handleCertChanged(app.fqdn);
 
                     iteratorCallback(); // move to next app
                 });
diff --git a/src/routes/oauth2.js b/src/routes/oauth2.js
index 58741baa6..48a3caf9e 100644
--- a/src/routes/oauth2.js
+++ b/src/routes/oauth2.js
@@ -239,7 +239,7 @@ function loginForm(req, res) {
         apps.get(result.appId, function (error, result) {
             if (error) return sendErrorPageOrRedirect(req, res, 'Unknown Application for those OAuth credentials');
 
-            var applicationName = result.intrinsicFqdn;
+            var applicationName = result.fqdn;
             render(applicationName, '/api/v1/apps/' + result.id + '/icon');
         });
     });
diff --git a/src/taskmanager.js b/src/taskmanager.js
index a9549e708..7f5b9dc1a 100644
--- a/src/taskmanager.js
+++ b/src/taskmanager.js
@@ -47,7 +47,7 @@ function resumeTasks(callback) {
 
             if (app.installationState === appdb.ISTATE_ERROR) return;
 
-            debug('Creating process for %s (%s) with state %s', app.intrinsicFqdn, app.id, app.installationState);
+            debug('Creating process for %s (%s) with state %s', app.fqdn, app.id, app.installationState);
             restartAppTask(app.id, NOOP_CALLBACK); // restart because the auto-installer could have queued up tasks already
         });
 
diff --git a/src/test/apptask-test.js b/src/test/apptask-test.js
index 2122eef66..754abea27 100644
--- a/src/test/apptask-test.js
+++ b/src/test/apptask-test.js
@@ -68,7 +68,6 @@ var APP = {
     runState: null,
     location: 'applocation',
     domain: DOMAIN_0.domain,
-    intrinsicFqdn: DOMAIN_0.domain + '.' + 'applocation',
     fqdn: DOMAIN_0.domain + '.' + 'applocation',
     manifest: MANIFEST,
     containerId: null,