diff --git a/certificate-management.adoc b/certificate-management.adoc
index 9472a6f..d77b2f7 100644
--- a/certificate-management.adoc
+++ b/certificate-management.adoc
@@ -68,6 +68,25 @@ can upload that certificate simply over the web interface.
 Note that the certificates key file, if provided, mustn't be password
 protected.
 
+[[sysadmin_certs_revert_custom]]
+Revert to the Default Certificate
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+To switch back from a custom certificate to the default certificate signed by
+the cluster CA, delete the custom certificate of the node with the 'Delete
+Custom Certificate' button under `Node -> Certificates`.
+
+If the web interface is not reachable anymore, for example after uploading a
+broken certificate, run the following command on the node instead:
+
+----
+root@proxmox:~# pvenode cert delete --restart 1
+----
+
+This deletes `/etc/pve/local/pveproxy-ssl.pem` and
+`/etc/pve/local/pveproxy-ssl.key` and restarts `pveproxy`, which then uses the
+default certificate in `/etc/pve/local/pve-ssl.pem` again.
+
 [[sysadmin_certs_get_trusted_acme_cert]]
 Trusted certificates via Let's Encrypt (ACME)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~