diff --git a/docs/frame-control.md b/docs/frame-control.md
index 8b9838a..d60af80 100644
--- a/docs/frame-control.md
+++ b/docs/frame-control.md
@@ -91,7 +91,8 @@ counts them while they run.
   Linux). Remote desktop first checks that the Frame's xrdp answers on port
   3389 (Developer Mode turns it on). On Windows it opens a connection file for
   user `steamos`, because `mstsc /v:` alone offers your Windows account, which
-  xrdp turns away. Sign in with the Developer Mode password. Sleep, restart and
+  xrdp turns away. Accept the warning about the Frame's own certificate, then
+  sign in with the Developer Mode password. Sleep, restart and
   shut down open a terminal window because SteamOS asks for the sudo password
   over SSH.
 
diff --git a/tests/test_rdp.py b/tests/test_rdp.py
index 4c2f806..eed2f85 100644
--- a/tests/test_rdp.py
+++ b/tests/test_rdp.py
@@ -65,6 +65,7 @@ class OpenRdp(unittest.TestCase):
         self.assertIn("username:s:steamos", lines)
         self.assertIn("steamos", message)
         self.assertIn("Developer Mode password", message)
+        self.assertIn("certificate", message)
 
     def test_nothing_listening_says_why_and_opens_nothing(self):
         self.xrdp.close()
diff --git a/ui/frame_host.py b/ui/frame_host.py
index 202d600..c5c028c 100644
--- a/ui/frame_host.py
+++ b/ui/frame_host.py
@@ -267,7 +267,9 @@ def open_steam_link():
 
 RDP_PORT = 3389
 RDP_USER = "steamos"  # xrdp signs in with the Developer Mode password, not this computer's
-RDP_LOGIN = f"sign in as {RDP_USER} with your Developer Mode password"
+# xrdp's certificate is its own, so every client warns about it first.
+RDP_LOGIN = (f"accept the warning about the Frame's certificate, then sign in as {RDP_USER} "
+             "with your Developer Mode password")
 
 
 def rdp_reachable(host, timeout=3):