diff --git a/.gitignore b/.gitignore
index a2ecfbe..455c5e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,4 @@ lib/www/client/source/dist/
 lib/www/client/dist/
 etc/surveys/*.yaml
 !etc/surveys/_*.yaml
+etc/ssl/*
diff --git a/etc/ssl/README.md b/etc/ssl/README.md
new file mode 100644
index 0000000..055991a
--- /dev/null
+++ b/etc/ssl/README.md
@@ -0,0 +1,3 @@
+# TLS certificates directory
+
+Drop TLS certificates required by Dougal in this directory. It is excluded by [`.gitignore`](../../.gitignore) so its contents should never be committed by accident (and shouldn't be committed on purpose!).