diff --git a/configs/samples/pjsip.conf.sample b/configs/samples/pjsip.conf.sample
index 8305616715..d6932e38c6 100644
--- a/configs/samples/pjsip.conf.sample
+++ b/configs/samples/pjsip.conf.sample
@@ -747,7 +747,10 @@
         ; "")
 ;ca_list_file=  ; File containing a list of certificates to read TLS ONLY
                 ; (default: "")
-;cert_file=     ; Certificate file for endpoint TLS ONLY (default: "")
+;cert_file=     ; Certificate file for endpoint TLS ONLY
+                ; Will read .crt or .pem file but only uses cert,
+                ; a .key file must be specified via priv_key_file
+                ; (default: "")
 ;cipher=        ; Preferred cryptography cipher names TLS ONLY (default: "")
 ;domain=        ; Domain the transport comes from (default: "")
 ;external_media_address=        ; External IP address to use in RTP handling
diff --git a/res/res_pjsip.c b/res/res_pjsip.c
index 7be8ff81e4..b350b7b775 100644
--- a/res/res_pjsip.c
+++ b/res/res_pjsip.c
@@ -821,6 +821,12 @@
 				</configOption>
 				<configOption name="cert_file">
 					<synopsis>Certificate file for endpoint (TLS ONLY)</synopsis>
+					<description><para>
+						A path to a .crt or .pem file can be provided.  However, only
+						the certificate is read from the file, not the private key.
+						The <literal>priv_key_file</literal> option must supply a
+						matching key file.
+					</para></description>
 				</configOption>
 				<configOption name="cipher">
 					<synopsis>Preferred cryptography cipher names (TLS ONLY)</synopsis>