diff --git a/doc/setup.texi b/doc/setup.texi
index 42cacdec8..39beef6d9 100644
--- a/doc/setup.texi
+++ b/doc/setup.texi
@@ -1259,9 +1259,12 @@ the mapping in the principals entry in the kerberos database.
 
 @section Certificates
 
-This section documents the requirements on the KDC and client
-certificates and the format used in the id-pkinit-san OtherName
-extention.
+This and following subsection documents the requirements on the KDC
+and client certificates and the format used in the id-pkinit-san
+OtherName extention.
+
+On how to create certificates, you should read @xref{Use OpenSSL to
+create certificates}.
 
 @subsection KDC certificate