Add intro for #scope, organize bullets, and add setup placeholders

Author: RebeccaTamachiro

src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx

@@ -38,24 +38,39 @@ While TLS 1.3 is the most recent and secure version, it is not supported by some
 
 ### Scope
 
-- For custom hostnames created via API, it is possible not to explicitly define a value for `min_tls_version`. When that is the case, whatever value is defined as your zone's [minimum TLS version](/ssl/edge-certificates/additional-options/minimum-tls/) (under **Edge certificates** > **Minimum TLS Version**) will be applied. To confirm whether a given custom hostname has a specific minimum TLS version set, use the following API call.
+Minimum TLS version exists both as a [zone-level setting](/ssl/edge-certificates/additional-options/minimum-tls/) (under **Edge certificates** > **Minimum TLS Version**) and as a custom hostname setting. What this implies is:
 
-<Details header="Example: check custom hostname settings">
+- For custom hostnames created via API, it is possible not to explicitly define a value for `min_tls_version`. When that is the case, whatever value is defined as your zone's minimum TLS version will be applied. To confirm whether a given custom hostname has a specific minimum TLS version set, use the following API call.
+
+<Details header="API example: check custom hostname settings">
 
 In the API documentation, refer to [Custom Hostname Details](/api/resources/custom_hostnames/methods/get/).
 
+TO-DO: Add APIRequest example
 
 </Details>
 
-- If you specify any other settings for that custom hostname via Dashboard, whichever value is set for Minimum TLS version will then override your zo
+- Whenever you make changes to a custom hostname via Dashboard, the value that is set for Minimum TLS version will apply. Meaning it will override a zone-level configuration applied as in the scenario above.
+
+- For custom hostnames with wildcards enabled, the direct custom hostname you create (`saas-customer.test`) will use the hostname-specific setting, while the others (`sub1.saas-customer.test`, `sub2.saas-customer.test`, etc) will default to the zone-level setting.
 
 ### Setup
 
+<Details header="Minimum TLS version for your zone">
+
+Refer to [Minimum TLS version - SSL/TLS](/ssl/edge-certificates/additional-options/minimum-tls/#zone-level).
+
+</Details>
+
+<Details header="Minimum TLS version for custom hostname">
+
 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account and website.
 2. Go to **SSL/TLS** > **Custom Hostnames**.
 3. Find the hostname to which you want to apply Minimum TLS Version. Select **Edit**.
 4. Choose the desired TLS version under **Minimum TLS Version** and select **Save**.
 
+</Details>
+
 ## Cipher suites
 
 For security and regulatory reasons, you may want to only allow connections from certain cipher suites. Cloudflare provides recommended values and full cipher suite reference in our [Cipher suites documentation](/ssl/edge-certificates/additional-options/cipher-suites/#resources).