diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9da0a33..ff60e38 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@ In Development
 * Roundcube updated to version 1.1.4.
 * When there's a problem delivering an outgoing message, a new 'warning' bounce will come after 3 hours and the box will stop trying after 2 days (instead of 5).
 * On multi-homed machines, Postfix now binds to the right network interface when sending outbound mail so that SPF checks on the receiving end will pass.
-* TLS certificate provisioning would crash if DNS propagation was in progress and a challenge failed.
+* TLS certificate provisioning would crash if DNS propagation was in progress and a challenge failed; might have shown the wrong error when provisioning fails.
 * Backup times were displayed with the wrong time zone.
 * On low-usage systems, don't hold backups for quite so long by taking a full backup more often.
 * Nightly status checks might fail if any domains had non-ASCII characters.
diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py
index d6cc7c9..28cc3f7 100755
--- a/management/ssl_certificates.py
+++ b/management/ssl_certificates.py
@@ -204,7 +204,7 @@ def get_certificates_to_provision(env, show_extended_problems=True, force_domain
 				domains_if_any.add(domain)
 
 			# It's valid. Should we report its validness?
-			if show_extended_problems:
+			elif show_extended_problems:
 				problems[domain] = "The certificate is valid for at least another 30 days --- no need to replace."
 
 	# Warn the user about domains hosted elsewhere.