diff --git a/content/references/configuration.md b/content/references/configuration.md
index ef10891..ed3f538 100644
--- a/content/references/configuration.md
+++ b/content/references/configuration.md
@@ -70,6 +70,23 @@ ALTER SYSTEM SET buffersize = '8G';
 
 As with the config file, these changes only take effect after a restart.
 
+## SSL configuration
+
+CedarDB supports encrypted client/server connections by default.
+The standard configuration sets up SSL / TLS with a self-signed certificate.
+The key material is stored in the database directory as `server.key` and `server.crt`.
+
+```shell
+# Regular SSL mode works out of the box
+psql 'postgresql://postgres@localhost:5432/postgres?sslmode=require'
+```
+
+Certificate verification needs either a signature by a public CA, or connections need to specify `sslrootcert` explicitly:
+
+```shell
+psql 'postgresql://postgres@localhost:5432/postgres?sslmode=verify-ca&sslrootcert=/path/to/server.crt'
+```
+
 ## Logging
 
 CedarDB prints log messages to the standard error output stream (stderr, fd 2).
diff --git a/data/releasenotes.json b/data/releasenotes.json
index 09de7c2..e370b1f 100644
--- a/data/releasenotes.json
+++ b/data/releasenotes.json
@@ -82,7 +82,7 @@
 			},
 			{
 				"type": "pg",
-				"note": "Switch to PostgreSQL compatible <tt>ssl_key_file</tt> and <tt>ssl_cert_file</tt> configuration parameters. Please consult our documentation on how to configure SSL."
+				"note": "Switch to PostgreSQL compatible <tt>ssl_key_file</tt> and <tt>ssl_cert_file</tt> configuration parameters. Please consult <a href=https://cedardb.com/docs/references/configuration/#ssl-configuration>our documentation</a> on how to configure SSL."
 			},
 			{
 				"type": "pg",