diff --git a/security/certificates/api-server.adoc b/security/certificates/api-server.adoc
index 425fd4347a..890539b762 100644
--- a/security/certificates/api-server.adoc
+++ b/security/certificates/api-server.adoc
@@ -11,4 +11,9 @@ cluster CA. Clients outside of the cluster will not be able to verify the
 API server's certificate by default. This certificate can be replaced
 by one that is issued by a CA that clients trust.
 
-include::modules/customize-certificates-api-add-named.adoc[leveloffset=+1]
+[NOTE]
+====
+In hosted control plane clusters, you cannot replace self-signed certificates from the API.
+====
+
+include::modules/customize-certificates-api-add-named.adoc[leveloffset=+1]
\ No newline at end of file