diff --git a/src/js/setupdns.js b/src/js/setupdns.js
index e2d35523b..87f89f121 100644
--- a/src/js/setupdns.js
+++ b/src/js/setupdns.js
@@ -24,7 +24,7 @@ app.controller('SetupDNSController', ['$scope', '$http', '$timeout', 'Client', f
     $scope.tlsProvider = [
         { name: 'Let\'s Encrypt Prod', value: 'letsencrypt-prod' },
         { name: 'Let\'s Encrypt Staging', value: 'letsencrypt-staging' },
-        { name: 'Self-Signed', value: 'fallback' },
+        { name: 'Self-Signed', value: 'fallback' }, // this is not 'Custom' because we don't allow user to upload certs during setup phase
     ];
 
     // If we migrate the api origin we have to poll the new location
diff --git a/src/views/domains.html b/src/views/domains.html
index 8950d4acb..a1b19dfc2 100644
--- a/src/views/domains.html
+++ b/src/views/domains.html
@@ -116,12 +116,21 @@
               </div>
 
               <!-- Fallback certificate -->
-              <label class="control-label" ng-show="domainConfigure.tlsConfig.provider.value === 'fallback'">Custom Wildcard Certificate (optional)</label>
-              <label class="control-label" ng-show="domainConfigure.tlsConfig.provider.value !== 'fallback'">Fallback Certificate (optional)</label>
-              <p>
-                  Certificates are automatically obtained and renewed from <a href="https://letsencrypt.org/" target="_blank">Let’s Encrypt</a>. See the current rate limit <a href="https://letsencrypt.org/docs/rate-limits/" target="_blank">here</a>.
-                  This wildcard certificate will be used should getting a Let’s Encrypt certificate fail. If not provided, an automatically generated self-signed certificate will be used as fallback.
-              </p>
+              <div ng-show="domainConfigure.tlsConfig.provider !== 'fallback'">
+                <label class="control-label">Fallback Certificate (optional)</label>
+                <p>
+                    Certificates are automatically obtained and renewed from <a href="https://letsencrypt.org/" target="_blank">Let’s Encrypt</a>. See the current rate limit <a href="https://letsencrypt.org/docs/rate-limits/" target="_blank">here</a>.
+                    This wildcard certificate will be used should getting a Let’s Encrypt certificate fail. If not provided, an automatically generated self-signed certificate will be used as fallback.
+                </p>
+              </div>
+
+              <div ng-show="domainConfigure.tlsConfig.provider === 'fallback'">
+                <label class="control-label">Custom Certificate</label>
+                <p>
+                  This <a href="https://cloudron.io/documentation/certificates/#setting-custom-certificates" target="_blank">wildcard certificate</a> will be used for all apps on this domain. If not provided, a self-signed certificate will be automatically generated.
+                </p>
+              </div>
+
               <div class="form-group" ng-class="{ 'has-error': (!fallbackCert.cert.$dirty && fallbackCert.error) }">
                   <div class="input-group">
                       <input type="file" id="fallbackCertFileInput" style="display:none"/>
diff --git a/src/views/domains.js b/src/views/domains.js
index 16129139a..b39cb6a6c 100644
--- a/src/views/domains.js
+++ b/src/views/domains.js
@@ -11,7 +11,7 @@ angular.module('Application').controller('DomainsController', ['$scope', '$locat
     $scope.tlsProvider = [
         { name: 'Let\'s Encrypt Prod', value: 'letsencrypt-prod' },
         { name: 'Let\'s Encrypt Staging', value: 'letsencrypt-staging' },
-        { name: 'Custom', value: 'fallback' },
+        { name: 'Custom Wildcard Certificate', value: 'fallback' },
     ];
 
     // keep in sync with setupdns.js