diff --git a/src/platform.js b/src/platform.js
index 3665e1ccd..96bd79b00 100644
--- a/src/platform.js
+++ b/src/platform.js
@@ -147,6 +147,8 @@ function startApps(existingInfra, callback) {
 function handleCertChanged(cn) {
     assert.strictEqual(typeof cn, 'string');
 
+    debug('handleCertChanged', cn);
+
     if (cn === '*.' + config.adminDomain() || cn === config.adminFqdn()) {
         mail.startMail(NOOP_CALLBACK);
     }
diff --git a/src/reverseproxy.js b/src/reverseproxy.js
index 02bc647fc..44cab4650 100644
--- a/src/reverseproxy.js
+++ b/src/reverseproxy.js
@@ -454,6 +454,8 @@ function renewCerts(options, auditSource, callback) {
                 let currentNginxConfig = safe.fs.readFileSync(appDomain.nginxConfigFilename, 'utf8') || '';
                 if (currentNginxConfig.includes(bundle.certFilePath)) return iteratorCallback();
 
+                debug(`renewCerts: creating new nginx config since ${appDomain.nginxConfigFilename} does not have ${bundle.certFilePath}`);
+
                 // reconfigure since the cert changed
                 var configureFunc;
                 if (appDomain.type === 'webadmin') configureFunc = writeAdminConfig.bind(null, bundle, constants.NGINX_ADMIN_CONFIG_FILE_NAME, config.adminFqdn());