From 8377f6b3bfdddf84397e2381b1da45656162fd64 Mon Sep 17 00:00:00 2001
From: Thore Goebel <git@thore.io>
Date: Thu, 27 Aug 2026 13:46:52 +0200
Subject: [PATCH] docs: Add warnings that KMIP client/server cert arguments are
 stubs

See https://github.com/NLnetLabs/cascade/issues/982
---
 doc/manual/build/man/cascade-hsm.1    | 32 +++++++++++++++++++++++++++
 doc/manual/source/man/cascade-hsm.rst | 16 ++++++++++++++
 2 files changed, 48 insertions(+)

diff --git a/doc/manual/build/man/cascade-hsm.1 b/doc/manual/build/man/cascade-hsm.1
index 8df1651ea..638ee756d 100644
--- a/doc/manual/build/man/cascade-hsm.1
+++ b/doc/manual/build/man/cascade-hsm.1
@@ -140,6 +140,14 @@ password set here will be used as the PKCS#11 PIN to login with.
 .B \-\-client\-cert <CLIENT_CERT_PATH>
 Optional path to a TLS certificate to authenticate to the KMIP server
 with. The file will be read and sent to the server.
+.sp
+\fBWARNING:\fP
+.INDENT 7.0
+.INDENT 3.5
+This argument \X'tty: link https://github.com/NLnetLabs/cascade/issues/982'\fI\%is not yet used\fP\X'tty: link'
+by Cascade.
+.UNINDENT
+.UNINDENT
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -149,6 +157,14 @@ THe file will be read and sent to the server.
 .sp
 The private key is needed to be able to prove to the KMIP server that
 you are the owner of the provided TLS client certificate.
+.sp
+\fBWARNING:\fP
+.INDENT 7.0
+.INDENT 3.5
+This argument \X'tty: link https://github.com/NLnetLabs/cascade/issues/982'\fI\%is not yet used\fP\X'tty: link'
+by Cascade.
+.UNINDENT
+.UNINDENT
 .UNINDENT
 .SS Server Certificate Verification:
 .INDENT 0.0
@@ -164,11 +180,27 @@ certificate, e.g. in a test environment.
 .TP
 .B \-\-server\-cert <SERVER_CERT_PATH>
 Optional path to a TLS PEM certificate for the server.
+.sp
+\fBWARNING:\fP
+.INDENT 7.0
+.INDENT 3.5
+This argument \X'tty: link https://github.com/NLnetLabs/cascade/issues/982'\fI\%is not yet used\fP\X'tty: link'
+by Cascade.
+.UNINDENT
+.UNINDENT
 .UNINDENT
 .INDENT 0.0
 .TP
 .B \-\-ca\-cert <CA_CERT_PATH>
 Optional path to a TLS PEM certificate for a Certificate Authority.
+.sp
+\fBWARNING:\fP
+.INDENT 7.0
+.INDENT 3.5
+This argument \X'tty: link https://github.com/NLnetLabs/cascade/issues/982'\fI\%is not yet used\fP\X'tty: link'
+by Cascade.
+.UNINDENT
+.UNINDENT
 .UNINDENT
 .SS Client Limits:
 .INDENT 0.0
diff --git a/doc/manual/source/man/cascade-hsm.rst b/doc/manual/source/man/cascade-hsm.rst
index d95ca261f..236b41cae 100644
--- a/doc/manual/source/man/cascade-hsm.rst
+++ b/doc/manual/source/man/cascade-hsm.rst
@@ -124,6 +124,10 @@ Client Certificate Authentication:
           Optional path to a TLS certificate to authenticate to the KMIP server
           with. The file will be read and sent to the server.
 
+          .. warning::
+             This argument `is not yet used <https://github.com/NLnetLabs/cascade/issues/982>`_
+             by Cascade.
+
 .. option:: --client-key <CLIENT_KEY_PATH>
 
           Optional path to a private key for client certificate authentication.
@@ -132,6 +136,10 @@ Client Certificate Authentication:
           The private key is needed to be able to prove to the KMIP server that
           you are the owner of the provided TLS client certificate.
 
+          .. warning::
+             This argument `is not yet used <https://github.com/NLnetLabs/cascade/issues/982>`_
+             by Cascade.
+
 Server Certificate Verification:
 ++++++++++++++++++++++++++++++++
 
@@ -147,10 +155,18 @@ Server Certificate Verification:
 
           Optional path to a TLS PEM certificate for the server.
 
+          .. warning::
+             This argument `is not yet used <https://github.com/NLnetLabs/cascade/issues/982>`_
+             by Cascade.
+
 .. option:: --ca-cert <CA_CERT_PATH>
 
           Optional path to a TLS PEM certificate for a Certificate Authority.
 
+          .. warning::
+             This argument `is not yet used <https://github.com/NLnetLabs/cascade/issues/982>`_
+             by Cascade.
+
 Client Limits:
 ++++++++++++++