diff --git a/ChangeLog.txt b/ChangeLog.txt
index ba35b9d3..d6f8056d 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -43,6 +43,7 @@ Client library:
 Clients:
 - mosquitto_sub and mosquitto_rr now open stdout in binary mode on Windows
   so binary payloads are not modified when printing.
+- Document TLS certificate behaviour when using `-p 8883`.
 
 Build:
 - Fix installation using WITH_TLS=no. Closes #2281.
diff --git a/man/mosquitto_pub.1.xml b/man/mosquitto_pub.1.xml
index 78d7e55a..800df2dc 100644
--- a/man/mosquitto_pub.1.xml
+++ b/man/mosquitto_pub.1.xml
@@ -108,8 +108,12 @@
 			connections. It is strongly recommended that you use an encrypted
 			connection for anything more than the most basic setup.</para>
 		<para>To enable TLS connections when using x509 certificates, one of
-			either <option>--cafile</option> or <option>--capath</option> must
+			either <option>--cafile</option> or <option>--capath</option> can
 			be provided as an option.</para>
+		<para>Alternatively, if the <option>-p 8883</option> option is used
+			then the OS provided certificates will be loaded and neither
+			<option>--cafile</option> or <option>--capath</option> are
+			needed</para>
 		<para>To enable TLS connections when using TLS-PSK, you must use the
 			<option>--psk</option> and the <option>--psk-identity</option>
 			options.</para>
diff --git a/man/mosquitto_rr.1.xml b/man/mosquitto_rr.1.xml
index 34305372..408a4408 100644
--- a/man/mosquitto_rr.1.xml
+++ b/man/mosquitto_rr.1.xml
@@ -119,8 +119,12 @@
 			connections. It is strongly recommended that you use an encrypted
 			connection for anything more than the most basic setup.</para>
 		<para>To enable TLS connections when using x509 certificates, one of
-			either <option>--cafile</option> or <option>--capath</option> must
+			either <option>--cafile</option> or <option>--capath</option> can
 			be provided as an option.</para>
+		<para>Alternatively, if the <option>-p 8883</option> option is used
+			then the OS provided certificates will be loaded and neither
+			<option>--cafile</option> or <option>--capath</option> are
+			needed</para>
 		<para>To enable TLS connections when using TLS-PSK, you must use the
 			<option>--psk</option> and the <option>--psk-identity</option>
 			options.</para>
diff --git a/man/mosquitto_sub.1.xml b/man/mosquitto_sub.1.xml
index 0bf19f86..7323bd1a 100644
--- a/man/mosquitto_sub.1.xml
+++ b/man/mosquitto_sub.1.xml
@@ -120,8 +120,12 @@
 			connections. It is strongly recommended that you use an encrypted
 			connection for anything more than the most basic setup.</para>
 		<para>To enable TLS connections when using x509 certificates, one of
-			either <option>--cafile</option> or <option>--capath</option> must
+			either <option>--cafile</option> or <option>--capath</option> can
 			be provided as an option.</para>
+		<para>Alternatively, if the <option>-p 8883</option> option is used
+			then the OS provided certificates will be loaded and neither
+			<option>--cafile</option> or <option>--capath</option> are
+			needed</para>
 		<para>To enable TLS connections when using TLS-PSK, you must use the
 			<option>--psk</option> and the <option>--psk-identity</option>
 			options.</para>