diff --git a/Documentation/configuration.md b/Documentation/configuration.md
index eeadd4065..245aaa6d2 100644
--- a/Documentation/configuration.md
+++ b/Documentation/configuration.md
@@ -134,7 +134,7 @@ To start etcd automatically using custom settings at startup in Linux, using a [
 The security flags help to [build a secure etcd cluster][security].
 
 ##### -ca-file [DEPRECATED]
-+ Path to the client server TLS CA file.
++ Path to the client server TLS CA file. `-ca-file ca.crt` could be replaced by `-trusted-ca-file ca.crt -client-cert-auth` and etcd will perform the same.
 + default: none
 
 ##### -cert-file
@@ -154,7 +154,7 @@ The security flags help to [build a secure etcd cluster][security].
 + default: none
 
 ##### -peer-ca-file [DEPRECATED]
-+ Path to the peer server TLS CA file.
++ Path to the peer server TLS CA file. `-peer-ca-file ca.crt` could be replaced by `-peer-trusted-ca-file ca.crt -peer-client-cert-auth` and etcd will perform the same.
 + default: none
 
 ##### -peer-cert-file
diff --git a/etcdmain/help.go b/etcdmain/help.go
index 987fe22fd..430f85112 100644
--- a/etcdmain/help.go
+++ b/etcdmain/help.go
@@ -87,7 +87,7 @@ proxy flags:
 security flags:
 
 	--ca-file '' [DEPRECATED]
-		path to the client server TLS CA file.
+		path to the client server TLS CA file. '-ca-file ca.crt' could be replaced by '-trusted-ca-file ca.crt -client-cert-auth' and etcd will perform the same.
 	--cert-file ''
 		path to the client server TLS cert file.
 	--key-file ''
@@ -97,7 +97,7 @@ security flags:
 	--trusted-ca-file ''
 		path to the client server TLS trusted CA key file.
 	--peer-ca-file '' [DEPRECATED]
-		path to the peer server TLS CA file.
+		path to the peer server TLS CA file. '-peer-ca-file ca.crt' could be replaced by '-peer-trusted-ca-file ca.crt -peer-client-cert-auth' and etcd will perform the same.
 	--peer-cert-file ''
 		path to the peer server TLS cert file.
 	--peer-key-file ''