Adding note about HCP to API server certificate docs

Author: lahinson

security/certificates/api-server.adoc

@@ -11,4 +11,9 @@ cluster CA. Clients outside of the cluster will not be able to verify the
 API server's certificate by default. This certificate can be replaced
 by one that is issued by a CA that clients trust.
 
-include::modules/customize-certificates-api-add-named.adoc[leveloffset=+1]
+[NOTE]
+====
+In hosted control plane clusters, you cannot replace self-signed certificates from the API.
+====
+
+include::modules/customize-certificates-api-add-named.adoc[leveloffset=+1]