[#3255] Added a note

diff --git a/doc/sphinx/arm/security.rst b/doc/sphinx/arm/security.rst
index 8ceb4f12ecd5e4a3c1cc892a2ae3d5a8b1e72f31..b6cf3fccf1cf4d8a01a29e34f70afdb21707e97a 100644 (file)
--- a/doc/sphinx/arm/security.rst
+++ b/doc/sphinx/arm/security.rst
@@ -36,6 +36,13 @@ protection possible:
    the two security mechanisms, and therefore no proof that the TLS client and server
    are the same as the HTTP authentication client and server.
 
+.. note::
+
+   On reconfiguration a new listener HTTP socket is opened only when the
+   address or the port was changed so to apply a TLS setup change, e.g.
+   a certificate update, Kea must be restarted (i.e. stopped and started
+   vs reloaded).
+
 .. _tls_config:
 
 Building Kea with TLS/HTTPS Support