diff --git a/README.md b/README.md
index 899938af..42de61b5 100644
--- a/README.md
+++ b/README.md
@@ -203,15 +203,22 @@ kubectl --kubeconfig=./kubeconfig create secret generic sops-gpg \
     --from-file=sops.asc=/dev/stdin
 ```
 
-4. Update files using `envsubst` or by updating the files listed below manually
+4. Export more environment variables for application configuration
 
 ```sh
+# The repo you created from this template
 export BOOTSTRAP_GITHUB_REPOSITORY="https://github.com/k8s-at-home/home-cluster"
-export BOOTSTRAP_METALLB_LB_RANGE="169.254.1.10-169.254.1.20"
+# Choose one of your domains or use a made up one
 export BOOTSTRAP_DOMAIN="k8s-at-home.com"
-export BOOTSTRAP_DOMAIN_CERT="k8s-at-home"
+# Pick a range of unused IPs that are on the same network as your nodes
+export BOOTSTRAP_METALLB_LB_RANGE="169.254.1.10-169.254.1.20"
+# The load balancer IP for ingress-nginx, choose from one of the available IPs above
 export BOOTSTRAP_INGRESS_NGINX_LB="169.254.1.10"
+```
 
+5. Create required files based on ALL exported environment variables.
+
+```sh
 envsubst < ./tmpl/.sops.yaml > ./.sops.yaml
 envsubst < ./tmpl/cluster-secrets.yaml > ./cluster/base/cluster-secrets.yaml
 envsubst < ./tmpl/cluster-settings.yaml > ./cluster/base/cluster-settings.yaml
@@ -219,9 +226,9 @@ envsubst < ./tmpl/gotk-sync.yaml > ./cluster/base/flux-system/gotk-sync.yaml
 envsubst < ./tmpl/secret.enc.yaml > ./cluster/core/cert-manager/secret.enc.yaml
 ```
 
-5. **Verify** all the above files have the correct information present
+6. **Verify** all the above files have the correct information present
 
-6. Encrypt `cluster/cluster-secrets.yaml` and `cert-manager/secret.enc.yaml` with SOPS
+7. Encrypt `cluster/cluster-secrets.yaml` and `cert-manager/secret.enc.yaml` with SOPS
 
 ```sh
 export GPG_TTY=$(tty)
@@ -231,9 +238,9 @@ sops --encrypt --in-place ./cluster/core/cert-manager/secret.enc.yaml
 
 :round_pushpin: Variables defined in `cluster-secrets.yaml` and `cluster-settings.yaml` will be usable anywhere in your YAML manifests under `./cluster`
 
-7. **Verify** all the above files are **encrypted** with SOPS
+8. **Verify** all the above files are **encrypted** with SOPS
 
-8. Push you changes to git
+9. Push you changes to git
 
 ```sh
 git add -A
@@ -241,7 +248,7 @@ git commit -m "initial commit"
 git push
 ```
 
-9. Install Flux
+10. Install Flux
 
 ```sh
 kubectl --kubeconfig=./kubeconfig apply --kustomize=./cluster/base/flux-system
diff --git a/cluster/apps/networking/ingress-nginx/helm-release.yaml b/cluster/apps/networking/ingress-nginx/helm-release.yaml
index 13740bdd..55e46dc9 100644
--- a/cluster/apps/networking/ingress-nginx/helm-release.yaml
+++ b/cluster/apps/networking/ingress-nginx/helm-release.yaml
@@ -32,7 +32,7 @@ spec:
         serviceMonitor:
           enabled: false
       extraArgs:
-        default-ssl-certificate: "networking/${SECRET_DOMAIN_CERT}-tls"
+        default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-tls"
       resources:
         requests:
           memory: 100Mi
diff --git a/cluster/apps/networking/wildcard-certificate/certificate.yaml b/cluster/apps/networking/wildcard-certificate/certificate.yaml
index d1de4478..9b04a327 100644
--- a/cluster/apps/networking/wildcard-certificate/certificate.yaml
+++ b/cluster/apps/networking/wildcard-certificate/certificate.yaml
@@ -2,10 +2,10 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: "${SECRET_DOMAIN_CERT}"
+  name: "${SECRET_DOMAIN/./-}"
   namespace: networking
 spec:
-  secretName: "${SECRET_DOMAIN_CERT}-tls"
+  secretName: "${SECRET_DOMAIN/./-}-tls"
   issuerRef:
     name: letsencrypt-production
     kind: ClusterIssuer
diff --git a/tmpl/cluster-secrets.yaml b/tmpl/cluster-secrets.yaml
index 9cad1acc..d575681e 100644
--- a/tmpl/cluster-secrets.yaml
+++ b/tmpl/cluster-secrets.yaml
@@ -6,5 +6,4 @@ metadata:
     namespace: flux-system
 stringData:
     SECRET_DOMAIN: ${BOOTSTRAP_DOMAIN}
-    SECRET_DOMAIN_CERT: ${BOOTSTRAP_DOMAIN_CERT}
     SECRET_CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL}