diff --git a/prepare-vms/lib/commands.sh b/prepare-vms/lib/commands.sh
index 117d9246..bd432776 100644
--- a/prepare-vms/lib/commands.sh
+++ b/prepare-vms/lib/commands.sh
@@ -123,7 +123,7 @@ _cmd_kube() {
     pssh --timeout 200 "
     if grep -q node1 /tmp/node && [ ! -f /etc/kubernetes/admin.conf ]; then
         kubeadm token generate > /tmp/token &&
-	sudo kubeadm init --token \$(cat /tmp/token)
+	sudo kubeadm init --token \$(cat /tmp/token) --apiserver-cert-extra-sans \$(cat /tmp/ipv4)
     fi"
 
     # Put kubeconfig in ubuntu's and docker's accounts
diff --git a/slides/k8s/localkubeconfig.md b/slides/k8s/localkubeconfig.md
index dc03e234..9c9ad553 100644
--- a/slides/k8s/localkubeconfig.md
+++ b/slides/k8s/localkubeconfig.md
@@ -49,7 +49,10 @@ Note: if you are following along with a different platform (e.g. Linux on an arc
 
 The output should look like this:
 ```
-Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.0", GitCommit:"641856db18352033a0d96dbc99153fa3b27298e5", GitTreeState:"clean", BuildDate:"2019-03-25T15:53:57Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}
+Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.0",
+GitCommit:"641856db18352033a0d96dbc99153fa3b27298e5", GitTreeState:"clean",
+BuildDate:"2019-03-25T15:53:57Z", GoVersion:"go1.12.1", Compiler:"gc",
+Platform:"linux/amd64"}
 ```
 
 ---
@@ -104,7 +107,6 @@ Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.0", GitCom
 - To update the server address, run:
   ```bash
   kubectl config set-cluster kubernetes --server=https://`X.X.X.X`:6443
-  kubectl config set-cluster kubernetes --insecure-skip-tls-verify
   # Make sure to replace X.X.X.X with the IP address of node1!
   ```
 
@@ -112,7 +114,7 @@ Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.0", GitCom
 
 class: extra-details
 
-## Why do we skip TLS verification?
+## What if we get a certificate error?
 
 - Generally, the Kubernetes API uses a certificate that is valid for:
 
@@ -130,7 +132,20 @@ class: extra-details
 
 - ... And that external IP address was not used when creating the certificate!
 
-.warning[It's better to NOT skip TLS verification; this is for educational purposes only!]
+---
+
+class: extra-details
+
+## Working around the certificate error
+
+- We need to tell `kubectl` to skip TLS verification
+
+  (only do this with testing clusters, never in production!)
+
+- The following command will do the trick:
+  ```bash
+  kubectl config set-cluster kubernetes --insecure-skip-tls-verify
+  ```
 
 ---