diff --git a/docs/admin-guide/configuration/https/acme.md b/docs/admin-guide/configuration/https/acme.md
index 899d97c7..927f8dd6 100644
--- a/docs/admin-guide/configuration/https/acme.md
+++ b/docs/admin-guide/configuration/https/acme.md
@@ -15,7 +15,7 @@ Before starting the actual configuration you need to get for your team the "EAB-
 
 ## Configuration for Webserver/Webservice
 
-1. Best place the "EAB-KID" and the "EAB-HMAC-KEY" [encrypted](../../puppet/hiera#secrets) as variables `acme::eab-kid` and `acme::eab-hmac-key` on your top level YAML file so that they are availabe on all your nodes if needed.
+1. Best place the "EAB-KID" and the "EAB-HMAC-KEY" [encrypted](../../puppet/hiera#secrets) as variables `acme::eab-kid` and `acme::eab-hmac-key` on your top level YAML file so that they are availabe on all your nodes if needed. Please ensure you encrypt them as string and not as files as newlines which got encrypted will break the script.
 2. Install the required software, at least `certbot`.
 3. Prepare a renewal script required to roll out new certficiates to your (web)server and place it in `/etc/letsencrypt/renewal-hooks/post/`
 4. Create a service which initializes `certbot` with all the required configuration. If you want to use more alias domain names, add them at the end of the `certbot` command as additional `--domain` parameters. At the end this initial command should also call the renewal-hook script to prepare the (web)server.
@@ -60,8 +60,8 @@ files::files:
           --cert-name %{::fqdn} --new-key \
           --eab-kid %{lookup('acme::eab-kid')} \
           --eab-hmac-key %{lookup('acme::eab-hmac-key')} \
-          --domain %{::fqdn}
-      /etc/letsencrypt/renewal-hooks/post/nginx.sh
+          --domain %{::fqdn} \
+      && /etc/letsencrypt/renewal-hooks/post/nginx.sh
 
 
 # Service which sets up certbot
@@ -86,6 +86,8 @@ base::timers:
     enable: true
 ```
 
+Note if you are using RHEL8 then `--new-key` is not supported yet by `certbot`.
+
 Keys managed by certbot will be saved in `/etc/letsencrypt/live`:
 
 Certificate: `/etc/letsencrypt/live/<your-domain>.psi.ch/fullchain.pem`
@@ -97,6 +99,7 @@ Your renewal script may also copy the files instead and also change permissions
 !!! note
     Important! Best use fullchain.pem as some tools like curl testmight not have the necessary intermediate certificates!
 
+
 If you want to do changes, e.g. to the aliases, then best revoke the old certificate:
 ```
 certbot revoke --cert-name $FQDN