Merge pull request #69269 from jmanthei/OCPBUGS-18064

Author: sheriff-rh

modules/private-clusters-about.adoc

@@ -22,7 +22,9 @@ The `*.apps` records in the public and private zone are identical, so when you d
 [discrete]
 [id="private-clusters-about-ingress-controller_{context}"]
 == Ingress Controller
-Because the default `Ingress` object is created as public, the load balancer is internet-facing and in the public subnets. You can replace the default Ingress Controller with an internal one.
+Because the default `Ingress` object is created as public, the load balancer is internet-facing and in the public subnets.
+
+The Ingress Operator generates a default certificate for an Ingress Controller to serve as a placeholder until you configure a custom default certificate. Do not use Operator-generated default certificates in production clusters. The Ingress Operator does not rotate its own signing certificate or the default certificates that it generates. Operator-generated default certificates are intended as placeholders for custom default certificates that you configure.
 
 [discrete]
 [id="private-clusters-about-api-server_{context}"]