diff --git a/CHANGES b/CHANGES
index 77ae2d55b..e420e73c0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2577,6 +2577,7 @@
 [7.3.5]
 * du: fix crash when filesystem is cifs/nfs/sshfs
 * Start with a default to not fail if no swap is present
+* Fix bug in cert cleanup logic causing it to repeatedly cleanup
 
 [7.4.0]
 * Update base image to jammy
diff --git a/src/reverseproxy.js b/src/reverseproxy.js
index d8841339c..d04baa8c8 100644
--- a/src/reverseproxy.js
+++ b/src/reverseproxy.js
@@ -592,7 +592,7 @@ async function cleanupCerts(locations, auditSource, progressCallback) {
     const certIds = await blobs.listCertIds();
     const removedCertNames = [];
     for (const certId of certIds) {
-        const certName = certId.match(new RegExp(`${blobs.CERT_PREFIX}-(.*).cert`))[0];
+        const certName = certId.match(new RegExp(`${blobs.CERT_PREFIX}-(.*).cert`))[1];
         if (certNamesInUse.has(certName)) continue;
 
         const cert = await blobs.getString(certId);