diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
index c19bff4f8..0b9139308 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
@@ -33,9 +33,14 @@
         <type>dropdown</type>
         <help><![CDATA[The ACME CA that should be used for this account and all associated certificates. Note that some of them offer paid services and may require a subscription. Check the <a href="https://github.com/acmesh-official/acme.sh/wiki/Server" target="_blank">acme.sh documentation</a> for a list of supported CAs.]]></help>
     </field>
+    <field>
+        <label>CA Options</label>
+        <type>header</type>
+        <style>ca_options ca_options_custom</style>
+    </field>
     <field>
         <id>account.custom_ca</id>
-        <label>Custom ACME CA URL</label>
+        <label>Custom CA URL</label>
         <type>text</type>
         <help><![CDATA[The HTTPS URL of the custom ACME CA that should be used for this account and all associated certificates. If using your own CA, make sure the Root CA is added to OPNsense's trust store. For example: https://acme-v02.api.letsencrypt.org/directory or https://ca.internal/acme/directory]]></help>
     </field>
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 0ec434d22..0ae3d6720 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -152,7 +152,7 @@
                 <custom_ca type="TextField">
                     <Required>N</Required>
                     <mask>/^https?:\/\/.*[^\/]$/</mask>
-                    <ValidationMessage>The url must be a valid ACME endpoint without a trailing slash.</ValidationMessage>
+                    <ValidationMessage>The URL must be a valid ACME endpoint without a trailing slash.</ValidationMessage>
                 </custom_ca>
                 <eab_kid type="TextField">
                     <Required>N</Required>
diff --git a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/accounts.volt b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/accounts.volt
index dfa7eb6cf..d9e417ebd 100644
--- a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/accounts.volt
+++ b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/accounts.volt
@@ -317,6 +317,16 @@ POSSIBILITY OF SUCH DAMAGE.
 
         });
 
+        // hook into on-show event for dialog to extend layout.
+        $('#DialogAccount').on('shown.bs.modal', function (e) {
+            // hide options that are irrelevant for the selected CA
+            $("#account\\.ca").change(function(){
+                $(".ca_options").hide();
+                $(".ca_options_"+$(this).val()).show();
+            });
+            $("#account\\.ca").change();
+        })
+
     });
 
 </script>