diff --git a/modules/nw-ingress-setting-a-custom-default-certificate.adoc b/modules/nw-ingress-setting-a-custom-default-certificate.adoc
index 046e17f7c9..cacb101ef7 100644
--- a/modules/nw-ingress-setting-a-custom-default-certificate.adoc
+++ b/modules/nw-ingress-setting-a-custom-default-certificate.adoc
@@ -32,6 +32,14 @@ certificate authority already included in the CA bundle as provided by the
 container userspace.
 ====
 
+[NOTE]
+====
+If you have intermediate certificates, they must be included in the `tls.crt`
+file of the secret containing a custom default certificate. Order matters when
+specifying a certificate; list your intermediate certificate(s) after any server
+certificate(s).
+====
+
 .Procedure
 
 The following assumes that the custom certificate and key pair are in the