clarify that an SSL cert can remain self-signed on the non-primary domains if the domain isn't being used for web