diff --git a/TODO.on.site b/TODO.on.site
index 61ac62b..e9ae803 100644
--- a/TODO.on.site
+++ b/TODO.on.site
@@ -3,9 +3,14 @@
 * Set CANONICAL_WEB_URL in `gerrit/environment`
 * Enable GitHub OAUTH in `gerrit/environment`
 
-To build:
-* nginx first because it creates selfsigned certificate `docker-compose build nginx`
-* then everything else `docker-compose build`
+Building using self-signed certificates:
+We always create a temporary, self-signed certificate which
+can be overwritten by certbot. If intending to test with the
+self-signed certificate, build nginx first:
+* `docker-compose build nginx`,
+then everything else:
+* `docker-compose build --build-arg SSL_VARIANT=selfsigned`
+which will register the self-signed certificate with Gerrit.
 
 Get containers up:
 * `docker-compose up`