diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 0bc29fc4fe2857fbf3ce50eb1bfa6d81b55073ae..5c2572caf24cbecd9d906f95fcee0e1a480cfd95 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -1,6 +1,6 @@
 # Troubleshooting
 
-Note: `cluster$` indicates that the commands should be run on your OAS cluster.
+Note: `cluster$` indicates that the commands should be run as root on your OAS cluster.
 
 ## HTTPS Certificates
 
@@ -10,6 +10,12 @@ services. If you experience invalid SSL certificates (i.e. your browser warns yo
 when visiting Nextcloud (`https://files.YOUR.CLUSTER.DOMAIN`) here's how to
 debug this:
 
+Did you create your cluster using the `--acme-live-environment` argument ?
+Please check the resulting value of the `acme_staging` key in
+`clusters/YOUR_CLUSTERNAME/settings.yml`. If this is set to `true`, certificates
+are fetched from the [Let's Encrypt staging API](https://letsencrypt.org/docs/staging-environment/),
+which can't be validated by default in your browser.
+
 Are all pods in the `cert-manager` namespace in the `READY` state ?
 
     cluster$ kubectl -n cert-manager get pods