diff --git a/src/concepts.mdx b/src/concepts.mdx
index 460ca1a5..cfa5d60b 100644
--- a/src/concepts.mdx
+++ b/src/concepts.mdx
@@ -1,7 +1,18 @@
 ---
 title: "Concepts"
+description: "Learn the core Ampersand concepts — builders, customers, providers, integrations, and installations — and how they fit together in a workflow."
 ---
 
+## Who's who
+
+Before diving into the concepts below, it helps to know the three actors in an Ampersand workflow:
+
+- **You** (the builder) — the software company using Ampersand to add integrations to your product.
+- **Your customers** — the businesses or users of your product who want it to connect to the SaaS tools they already use.
+- **Providers** — the third-party SaaS tools (Salesforce, HubSpot, Slack, etc.) that your customers hold accounts with and that your product needs to read from or write to.
+
+In short: you define one **integration** per provider in your `amp.yaml`, and each customer who connects their SaaS account through your product gets their own **installation** of that integration.
+
 ## Integration
 
 An **integration** defines how your application will interact with a third party SaaS tool. You will have a single integration for all of your customers that are connecting your application with a particular SaaS product. For example, you might have an integration called `mySalesforceIntegration`. Salesforce is the **provider** that we are integrating with.
diff --git a/src/customer-guides/netsuite.mdx b/src/customer-guides/netsuite.mdx
index 4f5dd52d..df04f581 100644
--- a/src/customer-guides/netsuite.mdx
+++ b/src/customer-guides/netsuite.mdx
@@ -1,5 +1,6 @@
 ---
 title: "NetSuite"
+description: "Connect a NetSuite account to an Ampersand integration using OAuth 2.0 Client Credentials (machine-to-machine) and TBA authentication."
 ---
 
 This guide walks you through connecting your NetSuite account to an integration using OAuth 2.0 Client Credentials (Machine to Machine).
@@ -91,7 +92,11 @@ openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem
 openssl req -new -x509 -key private-key.pem -out cert.pem -days 730
 ```
 
-The second command will prompt you for certificate details (country, organization name, email, etc.). **Press Enter at every prompt to accept the defaults** — these values are not used by the integration, so it doesn't matter what they are.
+The second command will prompt you for certificate details (country, organization name, email, etc.). These values are not used by the integration, so it doesn't matter what they are — you can press **Enter** to accept the defaults for each field.
+
+<Warning>
+Some OpenSSL builds reject a certificate where every field is left blank and fail with `error, no objects specified in config file`. If you hit this, re-run the second command and type any value (for example, `test`) for at least one prompt — **Common Name** works well — then press **Enter** through the rest.
+</Warning>
 
 #### c. Confirm the two files were created