diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a4cad6c6a..04462d7a64 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@
 Now displays `Using the default configuration for the local shared network.`
 instead of `Using the default definition for the 'local' shared network because ~/.config/dfx/networks.json does not define it.`
 
+### chore!: Improved error message about canister ranges when directly connecting to a node on a non-root subnet
+
 ### feat: `dfx start` for the shared local network stores replica state files in unique directories by options
 
 The state files for different replica versions are often incompatible,
diff --git a/src/dfx/src/lib/diagnosis.rs b/src/dfx/src/lib/diagnosis.rs
index 625f4fa351..16975f6640 100644
--- a/src/dfx/src/lib/diagnosis.rs
+++ b/src/dfx/src/lib/diagnosis.rs
@@ -47,6 +47,8 @@ pub fn diagnose(err: &AnyhowError) -> Diagnosis {
     if let Some(agent_err) = err.downcast_ref::<AgentError>() {
         if not_a_controller(agent_err) {
             return diagnose_http_403();
+        } else if *agent_err == AgentError::CertificateNotAuthorized() {
+            return subnet_not_authorized();
         }
     }
 
@@ -98,6 +100,11 @@ The most common way this error is solved is by running 'dfx canister update-sett
     )
 }
 
+fn subnet_not_authorized() -> Diagnosis {
+    let action_suggestion = "If you are connecting to a node directly instead of a boundary node, try using --provisional-create-canister-effective-canister-id with a canister id in the subnet's canister range. First non-root subnet: 5v3p4-iyaaa-aaaaa-qaaaa-cai, second non-root subnet: jrlun-jiaaa-aaaab-aaaaa-cai";
+    (None, Some(action_suggestion.to_string()))
+}
+
 fn duplicate_asset_key_dist_and_src(sync_error: &SyncError) -> bool {
     fn is_src_to_dist(path0: &Path, path1: &Path) -> bool {
         // .../dist/<canister name>/... and .../src/<canister name>/assets/...