diff --git a/certs/README.md b/certs/README.md
index a853af0..dc62916 100644
--- a/certs/README.md
+++ b/certs/README.md
@@ -1,7 +1,7 @@
 # Custom CA certificates
 
 Place any **additional CA certificates** needed to reach internal HTTPS services
-in this directory, as PEM files with a `.crt` or `.pem` extension:
+in this directory, as PEM files with a `.crt` extension:
 
 ```text
 certs/
@@ -50,7 +50,9 @@ so both system tools and Node.js applications trust the added certificates.
 * Only **public** CA certificates belong here. Never commit private material
   (`*.key`, `*.p12`, `*.pfx`) — everything matched here is copied into the image
   verbatim.
-* Files must be PEM encoded. Convert DER with:
+* Files must be PEM encoded and use the `.crt` extension. Any other extension
+  (`.pem`, `.cer`, …) is **silently ignored** by `update-ca-certificates`, so
+  rename it to `.crt`. Convert DER with:
 
   ```bash
   openssl x509 -inform der -in cert.der -out cert.crt
@@ -58,13 +60,19 @@ so both system tools and Node.js applications trust the added certificates.
 
 ## Troubleshooting
 
-If a certificate seems ignored, check that it parses and that the build picked
-it up:
+If a certificate seems ignored, the most likely cause is the extension: only
+files ending in `.crt` are installed. A `.pem` file produces no error and no
+warning, it is simply skipped. Rename it:
+
+```bash
+mv company-root.pem company-root.crt
+```
+
+Otherwise check that the file parses as a certificate:
 
 ```bash
 openssl x509 -in company-root.crt -noout -subject -issuer -dates
 ```
 
-A build that prints warnings from `update-ca-certificates` usually means a file
-in this directory is not a valid PEM certificate. The permissive `.crt`/`.pem`
-extensions mean a stray text file or archive will be picked up and rejected.
+A build that prints warnings from `update-ca-certificates` means a `.crt` file
+is present but is not valid PEM certificate data.