diff --git a/server/certificates/certificates.go b/server/certificates/certificates.go
index 64981ef..ff34775 100644
--- a/server/certificates/certificates.go
+++ b/server/certificates/certificates.go
@@ -37,6 +37,7 @@ func TLSConfig(mainDomainSuffix string,
 	noDNS01 bool,
 	rawDomain string,
 ) *tls.Config {
+	// every cert is at most 24h in the cache and 7 days before expiry the cert is renewed
 	keyCache := expirable.NewLRU[string, *tls.Certificate](32, nil, 24*time.Hour)
 
 	return &tls.Config{