diff --git a/src/reverseproxy.js b/src/reverseproxy.js
index a9f32eda7..bb775eeae 100644
--- a/src/reverseproxy.js
+++ b/src/reverseproxy.js
@@ -321,9 +321,14 @@ function ensureCertificate(vhost, domain, auditSource, callback) {
         let certFilePath = path.join(paths.APP_CERTS_DIR, `${vhost}.user.cert`);
         let keyFilePath = path.join(paths.APP_CERTS_DIR, `${vhost}.user.key`);
 
-        if (fs.existsSync(certFilePath) && fs.existsSync(keyFilePath)) return callback(null, { certFilePath, keyFilePath }, { renewed: false });
+        if (fs.existsSync(certFilePath) && fs.existsSync(keyFilePath)) {
+            debug(`ensureCertificate: ${vhost} will use custom app certs`);
+            return callback(null, { certFilePath, keyFilePath }, { renewed: false });
+        }
 
         if (domainObject.tlsConfig.provider === 'fallback') {
+            debug(`ensureCertificate: ${vhost} will use fallback certs`);
+
             return getFallbackCertificate(domain, function (error, bundle) {
                 if (error) return callback(error);