diff --git a/docs/04-certificate-authority.md b/docs/04-certificate-authority.md
index f8842d9..836db54 100644
--- a/docs/04-certificate-authority.md
+++ b/docs/04-certificate-authority.md
@@ -322,11 +322,18 @@ cat > kubernetes-csr.json <<EOF
 }
 EOF
 
+for i in 0 1 2; do
+  declare CONTROLLER_${i}=$(gcloud compute instances describe controller-$i \
+    --format 'value(networkInterfaces[0].networkIP)');
+done
+
+API_SERVER_SERVICE_IP=10.32.0.1
+
 cfssl gencert \
   -ca=ca.pem \
   -ca-key=ca-key.pem \
   -config=ca-config.json \
-  -hostname=10.32.0.1,10.240.0.10,10.240.0.11,10.240.0.12,${KUBERNETES_PUBLIC_ADDRESS},127.0.0.1,kubernetes.default \
+  -hostname=${API_SERVER_SERVICE_IP},${CONTROLLER_0},${CONTROLLER_1},${CONTROLLER_2},${KUBERNETES_PUBLIC_ADDRESS},127.0.0.1,kubernetes.default \
   -profile=kubernetes \
   kubernetes-csr.json | cfssljson -bare kubernetes