docs: Add TLS disclaimer
@@ -101,6 +101,12 @@ the options ``security.tls.cert`` and ``security.tls.key`` to paths to a
PEM-encoded TLS certificate and private key, respectively, to do so. If
TLS is enabled, the default port becomes 8443 rather than 8080.
+.. note::
+
+ To use Determined with TLS, you may need a private Certificate
+ Authority and Split-Horizon DNS, depending on where your
+ infrastructure resides.
+
.. _agent-network-proxy:
Configuring Trial Runner Networking
