diff --git a/ipa-server/ipa-gui/ipagui/templates/principallist.kid b/ipa-server/ipa-gui/ipagui/templates/principallist.kid
index dcd9dd4b8..d4177d8d7 100644
--- a/ipa-server/ipa-gui/ipagui/templates/principallist.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/principallist.kid
@@ -16,6 +16,14 @@
         <script type="text/javascript">
             document.getElementById("hostname").focus();
         </script>
+        <script type="text/javascript">
+            function confirmDownload() {
+              if (confirm("Are you sure you want to download this principal? It will reset the secret, invalidating any existing keytabs")) {
+                return true;
+              }
+              return false;
+            }
+        </script>
     </div>
     <div py:if='(principals != None) and (len(principals) > 0)'>
         <h2>${len(principals)} results returned:</h2>
@@ -33,7 +41,7 @@
           <tbody>
             <tr py:for="principal in principals">
                 <td>
-                    <a href="${tg.url('/principal/show',principal=principal.krbprincipalname)}"
+                    <a href="${tg.url('/principal/show',principal=principal.krbprincipalname)}" onclick="return confirmDownload();"
                     >${principal.hostname}</a>
                 </td>
                 <td>