From ec359f2bca5ac038c3a5638dc2a346f6e847f04e Mon Sep 17 00:00:00 2001
From: Dean Chen <862469039@qq.com>
Date: Mon, 17 Aug 2026 07:47:19 +0500
Subject: [PATCH] docs: say --tls still loads ~/.docker/ca.pem

--tls does not use the system CA pool. The client always opens
--tlscacert and fails if that file is missing, even without
--tlsverify.

Signed-off-by: Dean Chen <862469039@qq.com>
---
 docs/reference/commandline/docker.md | 5 +++++
 man/docker.1.md                      | 6 +++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/docs/reference/commandline/docker.md b/docs/reference/commandline/docker.md
index 73ef948beae2..598e560bd6d8 100644
--- a/docs/reference/commandline/docker.md
+++ b/docs/reference/commandline/docker.md
@@ -86,6 +86,11 @@ The base command for the Docker CLI.
 
 ## Description
 
+`--tls` turns on TLS for the client. The CLI still loads `--tlscacert`
+(default `~/.docker/ca.pem`) and errors if that file is missing. It does
+not use the system CA pool. Without `--tlsverify`, the daemon certificate
+is not verified.
+
 Depending on your Docker system configuration, you may be required to preface
 each `docker` command with `sudo`. To avoid having to use `sudo` with the
 `docker` command, your system administrator can create a Unix group called
diff --git a/man/docker.1.md b/man/docker.1.md
index d6048bd3b39f..472a50b2161b 100644
--- a/man/docker.1.md
+++ b/man/docker.1.md
@@ -38,9 +38,13 @@ unix://[/path/to/socket] to use.
 
 **--tls**=*true*|*false*
   Use TLS; implied by --tlsverify. Default is false.
+  The client still loads --tlscacert (default ~/.docker/ca.pem) and
+  errors if that file is missing. It does not fall back to the system
+  CA pool. Without --tlsverify the daemon certificate is not verified.
 
 **--tlscacert**=*~/.docker/ca.pem*
-  Trust certs signed only by this CA.
+  Trust certs signed only by this CA. Always used when TLS is on,
+  including --tls without --tlsverify.
 
 **--tlscert**=*~/.docker/cert.pem*
   Path to TLS certificate file.