diff --git a/roles/openvpn/tasks/main.yml b/roles/openvpn/tasks/main.yml
index 00640891e..8c8577767 100644
--- a/roles/openvpn/tasks/main.yml
+++ b/roles/openvpn/tasks/main.yml
@@ -13,8 +13,8 @@
 # (2) openvpn_handle: "" (EMPTY STRING) IS HOWEVER TOLERATED -- in which case
 # the OpenVPN server instead tries to use the 1st 6 chars of /etc/iiab/uuid
 
-# (3) Finally if there's no UUID, the OpenVPN server falls back to labelling
-# that machine as generic: "client1's certificate"
+# (3) Finally if there's no client UUID (/etc/iiab/uuid) -- the OpenVPN server
+# falls back to labelling that machine as generic: "client1's certificate"
 
 # SEE ALSO /etc/openvpn/scripts/announcer & /usr/bin/iiab-support from:
 # https://github.com/iiab/iiab/tree/master/roles/openvpn/templates