diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md
index c287c0e9e0a..68d71d48875 100644
--- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md
@@ -355,4 +355,4 @@ You have a couple of options:
 
 ## FAQ and Troubleshooting
 
-{{< ssl_faq >}}
+{{< ssl_faq_ha >}}
diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/_index.md
index 71a2072eac8..d5e214fd662 100644
--- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md
+++ b/content/rancher/v2.x/en/installation/ha-server-install/_index.md
@@ -454,4 +454,4 @@ You have a couple of options:
 
 ## FAQ and Troubleshooting
 
-{{< ssl_faq >}}
+{{< ssl_faq_ha >}}
diff --git a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md
index 3ba23d4ccc0..c43b6d867d9 100644
--- a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md
@@ -82,7 +82,6 @@ If you elect to use a self-signed certificate to encrypt communication, you must
 >Create a self-signed certificate.
 >
 >- The certificate files must be in [PEM format](#ssl-faq-troubleshooting).
->- The certificate files must be in base64.
 
 **To Install Rancher Using a Self-Signed Cert:**
 
@@ -102,7 +101,6 @@ If your cluster is public facing, it's best to use a certificate signed by a rec
 >**Prerequisites:**
 >
 >- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
 
 **To Install Rancher Using a Cert Signed by a Recognized CA:**
 
@@ -204,7 +202,7 @@ You have a couple of options:
 
 ## FAQ and Troubleshooting
 
-{{< ssl_faq >}}
+{{< ssl_faq_single >}}
 
 ## Persistent Data
 
diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node-install/_index.md
index 42843637e95..eb24c5085a3 100644
--- a/content/rancher/v2.x/en/installation/single-node-install/_index.md
+++ b/content/rancher/v2.x/en/installation/single-node-install/_index.md
@@ -91,7 +91,6 @@ Your Rancher install can use a self-signed certificate that you provide to encry
 >Create a self-signed certificate.
 >
 >- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
 >- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
 
 
@@ -118,7 +117,6 @@ If you're publishing your app publicly, you should ideally be using a certificat
 >**Prerequisites:**
 >
 >- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
 >- Make sure that the container includes your certificate file and the key file. Because your certificate is signed by a recognized CA, mounting an additional CA certificate file is unnecessary.
 
 **To Install Rancher Using a Certificate Signed by a Recognized CA:**
@@ -180,7 +178,7 @@ You have a couple of options:
 
 ## FAQ and Troubleshooting
 
-{{< ssl_faq >}}
+{{< ssl_faq_single >}}
 
 ## Persistent Data
 
diff --git a/layouts/shortcodes/ssl_faq.html b/layouts/shortcodes/ssl_faq_ha.html
similarity index 100%
rename from layouts/shortcodes/ssl_faq.html
rename to layouts/shortcodes/ssl_faq_ha.html
diff --git a/layouts/shortcodes/ssl_faq_single.html b/layouts/shortcodes/ssl_faq_single.html
new file mode 100644
index 00000000000..948bf60fb4a
--- /dev/null
+++ b/layouts/shortcodes/ssl_faq_single.html
@@ -0,0 +1,42 @@
+<h3 id="pem">How Do I Know if My Certificates are in PEM Format?</h3>
+
+<p>You can recognize the PEM format by the following traits:</p>
+<ul>
+	<li>The file begins with the following header:<br/> <code>-----BEGIN CERTIFICATE-----</code></li>
+	<li>The header is followed by a long string of characters. Like, really long.</li>
+	<li>The file ends with a footer:<br/> <code>-----END CERTIFICATE-----</code></li>
+</ul>
+
+<p><strong>PEM Certificate Example:</strong></p>
+
+<pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
+----BEGIN CERTIFICATE-----
+MIIGVDCCBDygAwIBAgIJAMiIrEm29kRLMA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNV
+... more lines
+VWQqljhfacYPgp8KJUJENQ9h5hZ2nSCrI+W00Jcw4QcEdCI8HL5wmg==
+-----END CERTIFICATE-----
+</pre>
+
+<h3 id="cert-order">What is the Order of Certificates if I Want to Add My Intermediate(s)?</h3>
+
+<p>The order of adding certificates is as follows:</p>
+
+<pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
+-----BEGIN CERTIFICATE-----
+%YOUR_CERTIFICATE%
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+%YOUR_INTERMEDIATE_CERTIFICATE%
+-----END CERTIFICATE-----
+</pre>
+
+<h3 id="validate-cert-chain">How Do I Validate My Vertificate Chain?</h3>
+
+<p>You can validate the certificate chain by using the <code>openssl</code> binary. If the output of the command (see the command example below) ends with <code>Verify return code: 0 (ok)</code>, your certificate chain is valid. The <code>ca.pem</code> file must be the same as you added to the <code>rancher/rancher</code> container. When using a certificate signed by a recognized Certificate Authority, you can omit the <code>-CAfile</code> parameter.</p>
+
+<p><strong>Command</strong></p>
+<pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
+openssl s_client -CAfile ca.pem -connect rancher.yourdomain.com:443
+...
+    Verify return code: 0 (ok)
+</pre>