Add download cert limitation

Author: maxvp

src/content/docs/cloudflare-one/connections/connect-devices/warp/user-side-certificates/index.mdx

@@ -11,6 +11,8 @@ Advanced security features such as [HTTPS traffic inspection](/cloudflare-one/po
 
 Gateway [generates a unique root CA](#generate-a-cloudflare-root-certificate) for each Zero Trust account and deploys its across the Cloudflare global network. Alternatively, Enterprise users can upload and deploy their own [custom certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/custom-certificate/).
 
+## Certificate status
+
 Zero Trust will indicate if a certificate is ready for use in inspection based on its deployment status:
 
 | Deployment status | Description                                                                                                    |
@@ -22,10 +24,6 @@ Zero Trust will indicate if a certificate is ready for use in inspection based o
 
 ## Generate a Cloudflare root certificate
 
-:::note[Certificate generation limitation]
-Each Zero Trust account can generate a new root certificate a maximum of three times per day.
-:::
-
 To generate a new Cloudflare root certificate for your Zero Trust organization:
 
 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Resources**.
@@ -36,6 +34,8 @@ To generate a new Cloudflare root certificate for your Zero Trust organization:
 
 The certificate will appear in your list of certificates as **Inactive**. To deploy your certificate and turn it on for inspection, you need to [activate the certificate](#activate-a-root-certificate).
 
+Each Zero Trust account can generate a new root certificate a maximum of three times per day.
+
 ## Activate a root certificate
 
 :::note

src/content/docs/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cert-with-warp.mdx

@@ -35,7 +35,7 @@ The certificate is required if you want to [apply HTTP policies to encrypted web
 
 1. (Optional) [Upload](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/custom-certificate/) a custom root certificate to Cloudflare.
 2. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **WARP client**.
-3. Enable **Install CA to system certificate store**.
+3. Turn on **Install CA to system certificate store**.
 4. [Install](/cloudflare-one/connections/connect-devices/warp/download-warp/) the WARP client on the device.
 5. [Enroll the device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) in your Zero Trust organization.
 
@@ -44,7 +44,7 @@ If a custom certificate is not provided, WARP will install the default [Cloudfla
 Next, [verify](#access-the-installed-certificate) that the certificate was successfully installed.
 
 :::note[Important]
-WARP only installs the system certificate — it does not install the certificate on individual applications. You will need to [manually add the certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cloudflare-cert/#add-the-certificate-to-applications) to applications that rely on their own certificate store.
+WARP only installs the system certificate -- it does not install the certificate to individual applications. You will need to [manually add the certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cloudflare-cert/#add-the-certificate-to-applications) to applications that rely on their own certificate store.
 :::
 
 ## Access the installed certificate
@@ -109,6 +109,6 @@ The certificate is also placed in `/var/lib/cloudflare-warp/installed_cert.pem`
 
 ## Uninstall the certificate
 
-If the certificate was installed by the WARP client, it is automatically removed when you disable **Install CA to system certificate store** or [uninstall WARP](/cloudflare-one/connections/connect-devices/warp/remove-warp/). WARP does not remove certificates that were installed manually (for example, certificates added to third-party applications).
+If the certificate was installed by the WARP client, it is automatically removed when you turn off **Install CA to system certificate store** or [uninstall WARP](/cloudflare-one/connections/connect-devices/warp/remove-warp/). WARP does not remove certificates that were installed manually (for example, certificates added to third-party applications).
 
 To manually remove the certificate, refer to the instructions supplied by your operating system or the third-party application.

src/content/docs/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cloudflare-cert.mdx

@@ -20,6 +20,10 @@ If your device does not support [certificate installation via WARP](/cloudflare-
 
 ## Download the Cloudflare root certificate
 
+:::note[Certificate download limitation]
+You can only download certificates from the Zero Trust dashboard.
+:::
+
 First, [generate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/#generate-a-cloudflare-root-certificate) and download the Cloudflare certificate. The certificate is available in both `.pem` and `.crt` file format. Certain applications require the certificate to be in a specific file type, so ensure you download the most appropriate file for your use case.
 
 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Resources**.