diff --git a/pkgs/router-webui/certificate.go b/pkgs/router-webui/certificate.go
index babc954..aa9b027 100644
--- a/pkgs/router-webui/certificate.go
+++ b/pkgs/router-webui/certificate.go
@@ -188,6 +188,7 @@ type certificateData struct {
 	Errors    FormErrors
 	Providers []DNSProvider
 	Status    string // the order's last result
+	Failed    bool   // the last order did not succeed: the log is shown open
 	Log       string
 }
 
@@ -214,7 +215,9 @@ func (a *app) certificateData(s Settings, f ACMEForm, errs FormErrors) certifica
 	if first := splitList(f.Domains); len(first) > 0 && s.acme().Enabled {
 		unit := "acme-order-renew-" + strings.ToLower(first[0]) + ".service"
 		if st := unitProperty(unit, "ActiveState"); st != "" {
-			d.Status = st + ", result " + unitProperty(unit, "Result")
+			res := unitProperty(unit, "Result")
+			d.Status = st + ", result " + res
+			d.Failed = res != "success" || st == "failed"
 			d.Log, _ = command("journalctl", "--no-pager", "-o", "cat", "-n", "15", "-u", unit)
 		}
 	}
diff --git a/pkgs/router-webui/templates/certificate.html b/pkgs/router-webui/templates/certificate.html
index 2b5bdec..1740ea3 100644
--- a/pkgs/router-webui/templates/certificate.html
+++ b/pkgs/router-webui/templates/certificate.html
@@ -37,11 +37,11 @@
   </fieldset>
   <button>Save</button>
 </form>
-<section>
-  <h2>Ordering</h2>
+<details{{if .Failed}} open{{end}}>
+  <summary>Issuing and renewal log{{if .Failed}} (the last run failed){{end}}</summary>
   {{if .Status}}<p class="muted">{{.Status}}</p>{{if .Log}}<pre class="log">{{.Log}}</pre>{{end}}
   {{else}}<p class="muted">Nothing yet. After you save and apply, the router orders the certificate (a minute or two); renewals follow 30 days before it expires and need no restart.</p>{{end}}
-</section>
+</details>
 {{end}}
 </div>
 {{end}}