diff --git a/static/directives/config/config-setup-tool.html b/static/directives/config/config-setup-tool.html
index 12caf46cd..ead4609bf 100644
--- a/static/directives/config/config-setup-tool.html
+++ b/static/directives/config/config-setup-tool.html
@@ -14,7 +14,7 @@
     </div>
 
     <!-- Custom SSL certificates -->
-    <div class="co-panel">
+    <div class="co-panel" id="custom-ssl">
       <div class="co-panel-heading">
         <i class="fa fa-certificate"></i> Custom SSL Certificates
       </div>
@@ -342,6 +342,16 @@
         </div>
 
         <table class="config-table" ng-if="config.FEATURE_SECURITY_SCANNER">
+          <tr>
+            <td>Authentication Key:</td>
+            <td>
+              <span class="config-service-key-field" service-name="{{ config.SECURITY_SCANNER_ISSUER_NAME || 'secscan' }}"></span>
+              <div class="help-text">
+                The security scanning service requires an authorized service key to speak to Quay. Once setup, the key
+                can be managed in the Service Keys panel under the Super User Admin Panel.
+              </div>
+            </td>
+          </tr>
           <tr>
             <td>Security Scanner Endpoint:</td>
             <td>
@@ -351,15 +361,8 @@
               <div class="help-text">
                 The HTTP URL at which the security scanner is running.
               </div>
-            </td>
-          </tr>
-          <tr>
-            <td>Authentication Key:</td>
-            <td>
-              <span class="config-service-key-field" service-name="{{ config.SECURITY_SCANNER_ISSUER_NAME || 'secscan' }}"></span>
-              <div class="help-text">
-                The security scanning service requires an authorized service key to speak to Quay. Once setup, the key
-                can be managed in the Service Keys panel under the Super User Admin Panel.
+              <div class="co-alert co-alert-info" ng-if="config.SECURITY_SCANNER_ENDPOINT.indexOf('https:') == 0" style="margin-top: 20px;">
+                Is the security scanner behind a domain signed with a <strong>self-signed TLS certificate</strong>? If so, please make sure to register your SSL CA in the <a href="#custom-ssl">custom certificates panel</a> above.
               </div>
             </td>
           </tr>