diff --git a/pkg/util/seclib2/certfile.go b/pkg/util/seclib2/certfile.go
index e1a21882c3..33537d4229 100644
--- a/pkg/util/seclib2/certfile.go
+++ b/pkg/util/seclib2/certfile.go
@@ -24,6 +24,10 @@ const (
 	certBeginString = "BEGIN CERTIFICATE"
 )
 
+// MergeCaCertFiles concatenates cert and ca file to form a chain, write it to
+// a tmpfile then return the path
+//
+// Callers are responsible for removing the returned tmpfile
 func MergeCaCertFiles(cafile string, certfile string) (string, error) {
 	tmpfile, err := ioutil.TempFile("", "cerfile.*.crt")
 	if err != nil {