diff --git a/examples/40-ingress-echoheaders.yaml b/examples/40-ingress-echoheaders.yaml
index 50af4fc7..a31eb1f9 100644
--- a/examples/40-ingress-echoheaders.yaml
+++ b/examples/40-ingress-echoheaders.yaml
@@ -3,7 +3,7 @@ kind: Ingress
 metadata:
   name: echoheaders
   namespace: default
-  annotation:
+  annotations:
     cert.gardener.cloud/purpose: managed
 spec:
   tls:
diff --git a/pkg/cert/source/reconciler.go b/pkg/cert/source/reconciler.go
index d06209b9..705f2af8 100644
--- a/pkg/cert/source/reconciler.go
+++ b/pkg/cert/source/reconciler.go
@@ -311,7 +311,7 @@ func (this *sourceReconciler) createEntryFor(logger logger.LogContext, obj resou
 	if this.targetclass != "" {
 		resources.SetAnnotation(cert, ANNOT_CLASS, this.targetclass)
 	}
-	if len(info.Domains) >= 0 {
+	if len(info.Domains) > 0 {
 		cert.Spec.CommonName = &info.Domains[0]
 		cert.Spec.DNSNames = info.Domains[1:]
 	}
@@ -371,7 +371,7 @@ func (this *sourceReconciler) updateEntry(logger logger.LogContext, info CertInf
 		mod.Modify(changed)
 		var cn *string
 		var dnsNames []string
-		if len(info.Domains) >= 0 {
+		if len(info.Domains) > 0 {
 			cn = &info.Domains[0]
 			dnsNames = info.Domains[1:]
 		}