diff --git a/check-certificates.rsc b/check-certificates.rsc
index e5683514..7e2fed04 100644
--- a/check-certificates.rsc
+++ b/check-certificates.rsc
@@ -164,7 +164,8 @@
   }
   $WaitFullyConnected;
 
-  :foreach Cert in=[ /certificate/find where !revoked !ca !scep-url expires-after<$CertRenewTime ] do={
+  :foreach Cert in=[ /certificate/find where !revoked !scep-url expires-after<$CertRenewTime \
+                     !ca (common-name or subject-alt-name) ] do={
     :local CertVal [ /certificate/get $Cert ];
     :local LastName;
     :local FetchName;
@@ -244,8 +245,8 @@
     }
   }
 
-  :foreach Cert in=[ /certificate/find where !revoked !scep-url !(expires-after=[]) \
-                     expires-after<$CertWarnTime !(fingerprint=[]) ] do={
+  :foreach Cert in=[ /certificate/find where !revoked !scep-url expires-after<$CertWarnTime \
+                     !(expires-after=[]) !(fingerprint=[]) ] do={
     :local CertVal [ /certificate/get $Cert ];
 
     :if ([ :len [ /certificate/scep-server/find where ca-cert=($CertVal->"ca") ] ] > 0) do={
diff --git a/contrib/html.sh b/contrib/html.sh
index 03eba23d..3d30432b 100755
--- a/contrib/html.sh
+++ b/contrib/html.sh
@@ -13,7 +13,9 @@ sed \
 markdown -f toc,idanchor "${1}" | sed \
 	-e 's/href="\([-_\./[:alnum:]]*\)\.md\(#[-[:alnum:]]*\)\?"/href="\1.html\2"/g' \
 	-e '/<h[1234] /s| id="\(.*\)">| id="\L\1">|' \
-	-e '/<h[1234] /s|-2[1789cd]-||g' -e '/<h[1234] /s|--26-amp-3b-||g' \
+	-e '/<h[1234] /s|-2[1789cd]-||g' \
+	-e '/<h[1234] /s|-3[f]-||g' \
+	-e '/<h[1234] /s|--26-amp-3b-||g' \
 	-e '/^<pre>/s|pre|pre class="code" onclick="CopyToClipboard(this)"|g' \
 	-e '/The above link may be broken on code hosting sites/s|blockquote|blockquote style="display: none;"|'
 
diff --git a/doc/dhcp-to-dns.md b/doc/dhcp-to-dns.md
index 3636dfa3..a7e7a680 100644
--- a/doc/dhcp-to-dns.md
+++ b/doc/dhcp-to-dns.md
@@ -80,6 +80,23 @@ Note this information can be configured in wireless access list with
 then due to script execution order. Decrease the scheduler interval to
 reduce the effect.
 
+Frequently asked questions
+--------------------------
+
+### Is it possible to have the hostname in reverse lookup?
+
+It used to be like that in the beginning. But there are way too many special
+cases... Devices without hostname, devices with same hostname, devices
+switching from one network to another, devices with same hostname in
+different network, ...
+
+Fixing one broke another. It never really worked without problems. So
+finally the code ended with what we have now.
+
+I know about that side effect and limitation with reverse lookup, but
+there's really no (easy) way to get that right without mac address. The
+reverse lookup will always give a name based on mac address.
+
 See also
 --------