From f724480c7b25936b7c766108f7913e90e78f7176 Mon Sep 17 00:00:00 2001
From: Josh Souza <josh.souza@greenhouse.io>
Date: Tue, 22 Jan 2019 10:09:24 -0800
Subject: [PATCH] Add documentation regarding using a certificate chain

---
 docs/configuration/transports.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/configuration/transports.rst b/docs/configuration/transports.rst
index a705bc9..abd5347 100644
--- a/docs/configuration/transports.rst
+++ b/docs/configuration/transports.rst
@@ -77,6 +77,8 @@ Connect
 The ``tls`` transport uses TCP + TLS with client authentication using client certificates.
 The client identity is the common name (CN) presented in the client certificate.
 It is recommended to set up a dedicated CA infrastructure for this transport, e.g. using OpenVPN's `EasyRSA <https://github.com/OpenVPN/easy-rsa>`_.
+When utilizing a CA infrastructure, provide a full chain certificate with the sender's certificate first in the list, with each following certificate directly certifying the one preceding it, per `TLS's specification<https://tools.ietf.org/html/rfc5246#section-7.4.2>`.
+
 For a simple 2-machine setup, see the :ref:`instructions below<transport-tcp+tlsclientauth-2machineopenssl>`.
 
 The implementation uses `Go's TLS library <https://golang.org/pkg/crypto/tls/>`_.