diff --git a/webmin/edit_ssl.cgi b/webmin/edit_ssl.cgi
index 5199df5fd..42b56285b 100755
--- a/webmin/edit_ssl.cgi
+++ b/webmin/edit_ssl.cgi
@@ -261,16 +261,7 @@ print ui_tabs_start_tab("mode", "lets");
 my $err = &check_letsencrypt();
 print $text{'ssl_letsdesc'};
 if (!$err) {
-	print &ui_tag('span',
-		&ui_details({
-			'class' => 'inline inlined',
-			'title' => '',
-			'content' => $text{'ssl_letsdesc2'},
-			}))."\n".
-		&ui_tag('style',
-			".ui--span>details.inline>summary+span {\n".
-			"margin-top: 0;\n".
-			"}\n");
+	print "<p>", $text{'ssl_letsdesc2'}, "</p>\n";
 	}
 print "<p>\n";
 
@@ -283,7 +274,7 @@ if ($err) {
 	}
 else {
 	# Show form to create a cert
-	print &ui_form_start("letsencrypt.cgi");
+	print &ui_form_start("letsencrypt.cgi", "post");
 	print &ui_table_start($text{'ssl_letsheader'}, undef, 2);
 
 	# For domain names
@@ -375,31 +366,34 @@ else {
 			  [ [ 0, $text{'ssl_staging0'} ],
 			    [ 1, $text{'ssl_staging1'} ] ]));
 
-	my $acme_extra = &ui_table_start(undef, undef, 2);
-	$acme_extra .= &ui_table_row($text{'ssl_acmedir'},
+	# Provider settings are ordinary rows in the certificate form
+	print &ui_table_row($text{'ssl_acmedir'},
 		&ui_textbox("directory_url",
-			    $config{'letsencrypt_directory_url'}, 60)."<br>\n".
+			    $config{'letsencrypt_directory_url'}, 40)."<br>\n".
 		&ui_note($text{'ssl_acmedirdesc'}, 0));
-	$acme_extra .= &ui_table_row($text{'ssl_acmekid'},
-		&ui_textbox("eab_kid",
-			    $config{'letsencrypt_eab_kid'}, 40)."<br>\n".
-		&ui_note($text{'ssl_acmekiddesc'}, 0));
-	$acme_extra .= &ui_table_row($text{'ssl_acmehmac'},
-		&ui_password("eab_hmac",
-			     $config{'letsencrypt_eab_hmac'}, 50)."<br>\n".
+	# Keep both EAB credentials controlled by the same choice
+	my $eab_disabled = $config{'letsencrypt_eab_kid'} eq '';
+	print &ui_table_row($text{'ssl_acmeeab'},
+		&ui_radio_table("eab_kid_def", $eab_disabled ? 1 : 0,
+			[ [ 1, $text{'config_none'}, undef,
+			    &js_disable_inputs([ "eab_kid", "eab_hmac" ],
+					       [ ], "onClick") ],
+			  [ 0, $text{'config_setto'},
+			    &ui_textbox("eab_kid",
+				$config{'letsencrypt_eab_kid'}, 32,
+				$eab_disabled, undef, 'autocomplete="off" '.
+				'placeholder="'.&quote_escape($text{'ssl_acmekid'}).'" '.
+				'aria-label="'.&quote_escape($text{'ssl_acmekid'}).'"')."<br>\n".
+			    &ui_textbox("eab_hmac",
+				$config{'letsencrypt_eab_hmac'}, 32,
+				$eab_disabled, undef,
+				'autocomplete="new-password" '.
+				'placeholder="'.&quote_escape($text{'ssl_acmehmac'}).'" '.
+				'aria-label="'.&quote_escape($text{'ssl_acmehmac'}).'"'),
+			    &js_disable_inputs([ ], [ "eab_kid", "eab_hmac" ],
+					       "onClick") ] ], 1)."<br>\n".
+		&ui_note($text{'ssl_acmekiddesc'}, 0)."<br>\n".
 		&ui_note($text{'ssl_acmehmacdesc'}, 0));
-	$acme_extra .= &ui_table_end();
-	print &ui_table_row($text{'ssl_acmeopts'},
-		&ui_details({
-			'class' => 'inline inlined',
-			'html' => 1,
-			'title' => $text{'ssl_acmeextra'},
-			'content' => $acme_extra,
-			})."\n".
-		&ui_tag('style',
-			"tr>td>details.inline>summary+span {\n".
-			"margin-left: 0;\n".
-			"}\n"));
 
 	# Renewal option
 	my $job = &find_letsencrypt_cron_job();
diff --git a/webmin/lang/en b/webmin/lang/en
index 8c8e19c9f..4eed7ef12 100644
--- a/webmin/lang/en
+++ b/webmin/lang/en
@@ -457,9 +457,10 @@ ssl_acmeopts=Provider settings
 ssl_acmeextra=Show advanced settings
 ssl_acmedir=Custom ACME directory URL
 ssl_acmedirdesc=If set, this overrides the default provider server above.
-ssl_acmekid=External Account Binding key ID
+ssl_acmeeab=External Account Binding
+ssl_acmekid=Key ID
 ssl_acmekiddesc=Optional. Some ACME providers require this in addition to the directory URL.
-ssl_acmehmac=External Account Binding HMAC key
+ssl_acmehmac=HMAC key
 ssl_acmehmacdesc=Optional. Requires the native Certbot client when used.
 
 newkey_err=Failed to create SSL key
diff --git a/webmin/letsencrypt.cgi b/webmin/letsencrypt.cgi
index f248df764..fbae93cd7 100755
--- a/webmin/letsencrypt.cgi
+++ b/webmin/letsencrypt.cgi
@@ -31,6 +31,10 @@ foreach my $dom (@doms) {
 		&error($text{'letsencrypt_edom'});
 	}
 my $has_ip_doms = &letsencrypt_doms_have_ips(\@doms);
+# Ignore unused EAB fields, even if a password manager filled them in
+if ($in{'eab_kid_def'}) {
+	$in{'eab_kid'} = $in{'eab_hmac'} = '';
+	}
 $in{'directory_url'} = &trim($in{'directory_url'});
 $in{'eab_kid'} = &trim($in{'eab_kid'});
 $in{'eab_hmac'} = &trim($in{'eab_hmac'});