diff --git a/docker/containers/tactical-nginx/entrypoint.sh b/docker/containers/tactical-nginx/entrypoint.sh
index f67e691c..aa2aea6c 100644
--- a/docker/containers/tactical-nginx/entrypoint.sh
+++ b/docker/containers/tactical-nginx/entrypoint.sh
@@ -20,7 +20,7 @@ if [ "${CERT_PRIV_KEY}" != '' ] || [ "${CERT_PUB_KEY}" != '' ]; then
 else
   # generate a self signed cert
   if [ ! -f "${CERT_PRIV_PATH}" ] || [ ! -f "${CERT_PUB_PATH}" ]; then
-    rootdomain=$(echo ${API_HOST} | cut -d "." -f 2,3 )
+    rootdomain=$(echo ${API_HOST} | cut -d "." -f2- )
     openssl req -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out ${CERT_PUB_PATH} -keyout ${CERT_PRIV_PATH} -subj "/C=US/ST=Some-State/L=city/O=Internet Widgits Pty Ltd/CN=*.${rootdomain}"
   fi
 fi