diff --git a/TLS.md b/TLS.md
new file mode 100644
index 0000000..d5f2ddb
--- /dev/null
+++ b/TLS.md
@@ -0,0 +1,8 @@
+TLS can be enabled in the `Advanced` section. You will need a certificate and key for this. You can get these from [letsEncrypt](https://letsencrypt.org), or if using on a local network or placing behind a reverse proxy, you can generate them yourself with:
+
+```sh
+$ openssl genrsa -out server.key 2048 # Your key file, set the path to this in [advanced]/tls_key
+$ openssl req -new -x509 -key server.key -out server.pem -days 365 # Your cert, set the path to this in [advanced]/tls_cert
+```
+When enabled, jfa-go runs on port 8057 by default, which you can change with `[advanced]/tls_port`.
+