diff --git a/security/certificate_types_descriptions/aggregated-api-client-certificates.adoc b/security/certificate_types_descriptions/aggregated-api-client-certificates.adoc
index 213351c82775..8ccd567bec33 100644
--- a/security/certificate_types_descriptions/aggregated-api-client-certificates.adoc
+++ b/security/certificate_types_descriptions/aggregated-api-client-certificates.adoc
@@ -6,21 +6,29 @@ include::_attributes/common-attributes.adoc[]
 
 toc::[]
 
+[role="_abstract"]
+Review aggregated API client certificate validity and automatic rotation in {product-title} to plan maintenance for extension API server authentication.
+
+[id="aggregated-api-client-certificates-purpose_{context}"]
 == Purpose
 
-Aggregated API client certificates are used to authenticate the KubeAPIServer when connecting to the Aggregated API Servers.
+Aggregated API client certificates are used to authenticate the `KubeAPIServer` when connecting to the aggregated API servers.
 
+[id="aggregated-api-client-certificates-management_{context}"]
 == Management
 
 These certificates are managed by the system and not the user.
 
+[id="aggregated-api-client-certificates-expiration_{context}"]
 == Expiration
-This CA is valid for 30 days.
+
+This certificate authority (CA) is valid for 30 days.
 
 The managed client certificates are valid for 30 days.
 
 CA and client certificates are rotated automatically through the use of controllers.
 
+[id="aggregated-api-client-certificates-customization_{context}"]
 == Customization
 
 You cannot customize the aggregated API server certificates.