diff --git a/README.md b/README.md
index 5f5fcef..a0ec1f9 100644
--- a/README.md
+++ b/README.md
@@ -31,3 +31,12 @@ name.of.the.server linkpass=yourreceivepassword sid=123 autoconn=other.server.na
 ## caveats
 - ini seems to have horrible variable typing, so weird things can happen like `sid=2E5` turning into `sid=200000` (even if you quote it, wtf). use yaml for your hosts file if you need strict typing
 - this playbook currently only supports each server having one server set to `autoconn`
+
+## certbot
+consider adding `--preferred-chain 'ISRG Root X1'` to
+certbot invocations if getting cert from letsencrypt. their
+old cross signature is expired but still included to support
+older android devices, however this breaks some irc clients
+like mIRC. this option requests the cert without the expired
+cross signature
+