Improve macOS guidance

Author: maxvp

src/content/docs/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cert-with-warp.mdx

@@ -38,10 +38,11 @@ The certificate is required if you want to [apply HTTP policies to encrypted web
 3. Turn on [**Install CA to system certificate store**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#install-ca-to-system-certificate-store).
 4. [Install](/cloudflare-one/connections/connect-devices/warp/download-warp/) the WARP client on the device.
 5. [Enroll the device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) in your Zero Trust organization.
+6. (Optional) If the device is running macOS Ventura `13.5` or newer, [manually trust the certificate](#manually-trust-the-certificate).
 
 If a custom certificate is not provided, WARP will install the default [Cloudflare certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cloudflare-cert/#download-the-cloudflare-root-certificate) in the system keychain for all users. If you uploaded a custom certificate, the WARP client will deploy your custom certificate instead of the Cloudflare certificate.
 
-WARP will only install the [certificate set to **In-Use**](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/#certificate-status). If you turn on a new certificate for inspection, WARP will automatically install that certificate to your users' devices.
+WARP will only install the [certificate set to **In-Use**](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/#certificate-status). If you turn on a new certificate for inspection, WARP will automatically install the new certificate to your users' devices and remove the old certificate.
 
 Next, [verify](#access-the-installed-certificate) that the certificate was successfully installed.
 
@@ -72,16 +73,16 @@ To access the installed certificate in macOS:
 3. Open your certificate. The default Cloudflare certificate is named **Cloudflare for Teams ECC Certificate Authority**.
 4. If the certificate is trusted by all users, Keychain Access will display **This certificate is marked as trusted for all users**.
 
-:::note
-Certain macOS versions (including macOS Ventura `13.5` and newer) do not allow WARP to automatically trust the certificate. To manually trust the certificate:
+The WARP client will also place the certificate in `/Library/Application Support/Cloudflare/installed_cert.pem` for reference by scripts or tools.
+
+#### Manually trust the certificate
+
+macOS Ventura `13.5` and newer do not allow WARP to automatically trust the certificate. To manually trust the certificate:
 
 1. Select **Trust**.
 2. Set **When using this certificate** to _Always Trust_.
 
 Alternatively, you can configure your mobile device management (MDM) to automatically trust the certificate on all of your organization's devices.
-:::
-
-The WARP client will also place the certificate in `/Library/Application Support/Cloudflare/installed_cert.pem` for reference by scripts or tools.
 
 ### Linux