diff --git a/tools/geneos/docs/geneos_config.md b/tools/geneos/docs/geneos_config.md
index bcf22210..0fd144ec 100644
--- a/tools/geneos/docs/geneos_config.md
+++ b/tools/geneos/docs/geneos_config.md
@@ -42,6 +42,7 @@ The base URL for downloads for automating installations. Not yet used. If files
 | Command | Description |
 |-------|-------|
 | [`geneos config export`](geneos_config_export.md)	 | Export Instances |
+| [`geneos config import`](geneos_config_import.md)	 | import Instances |
 | [`geneos config set`](geneos_config_set.md)	 | Set program configuration |
 | [`geneos config show`](geneos_config_show.md)	 | Show program configuration |
 | [`geneos config unset`](geneos_config_unset.md)	 | Unset a program parameter |
diff --git a/tools/geneos/docs/geneos_config_import.md b/tools/geneos/docs/geneos_config_import.md
new file mode 100644
index 00000000..156acf29
--- /dev/null
+++ b/tools/geneos/docs/geneos_config_import.md
@@ -0,0 +1,18 @@
+# `geneos config import`
+
+Import one or more instances from a `tar.gz` archive created by `geneos config export`
+
+
+```text
+geneos config import [flags] [TYPE] [NAME...]
+```
+
+## Examples
+
+```bash
+
+```
+
+## SEE ALSO
+
+* [geneos config](geneos_config.md)	 - Configure Command Behaviour
diff --git a/tools/geneos/docs/geneos_webserver.md b/tools/geneos/docs/geneos_webserver.md
index 1529e3b1..64db1081 100644
--- a/tools/geneos/docs/geneos_webserver.md
+++ b/tools/geneos/docs/geneos_webserver.md
@@ -4,6 +4,10 @@ A `webserver` is an instance of a Web Dashboard Server.
 
 A new `webserver` instance is created using local package configuration files, therefore the same package version must be installed locally as on any remote host.
 
+`geneos` will manage TLS certificates for the webserver instance. When you create a new instance, assuming your Geneos installation has TLS initialised, a new certificate and private key will be created as for other component types but these will also then be added to the Java keystore referenced in the `config/security.properties` file. If you replace or renew the instance certificate or private key you should then use the `geneos rebuild webserver NAME` command to rebuild the keystore file. If you change the `security.properties` file you may need to manually delete the (old) keystore file before running `rebuild`.
+
+If you use `geneos deploy webserver` you can also provide an externally generated certificate bundle without having to initialise TLS for other components.
+
 ```text
 geneos webserver
 ```