diff --git a/README.adoc b/README.adoc
index 550fda9..f4200e5 100644
--- a/README.adoc
+++ b/README.adoc
@@ -125,6 +125,10 @@ as a `forking` type systemd user service.
 
 Client Certificates
 -------------------
+'degesch' will use the SASL EXTERNAL method to authenticate using the TLS
+client certificate specified by the respective server's `tls_cert` option
+if you add `sasl` to the `capabilities` option and the server supports this.
+
 'kike' uses SHA-1 fingerprints of TLS client certificates to authenticate users.
 To get the fingerprint from a certificate file in the required form, use: