diff --git a/debian/changelog b/debian/changelog
index e3774ac0ed..dbe846a901 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,7 @@ gitlab (8.9.0+dfsg-5) unstable; urgency=medium
   * Tighten dependencies
   * Don't run gitlab:shell:install in postinst (Closes: #831877)
     (installed config.yml works)
+  * Add a note about CAcert and browser trust
   
   [ Dmitry Smirnov ]
   * Do not leave dangling symlinks behind after purge
diff --git a/debian/gitlab.templates b/debian/gitlab.templates
index 8233f36503..d4f640ffa1 100644
--- a/debian/gitlab.templates
+++ b/debian/gitlab.templates
@@ -23,6 +23,8 @@ _Description: Enable https?
  .
  Some certificate authorities like Let's Encrypt (letsencrypt.org), CAcert
  (cacert.org), or WoSign (buy.wosign.com/free) offer free SSL certificates.
+ Note: CAcert issued certificates are not trusted by all browsers, it requires
+ installing CAcert's root certificate in such cases.
  .
  Nginx must be reloaded after the certificate and key files are made available
  at /etc/gitlab/ssl. letsencrypt package may be used to automate interaction