diff --git a/docs/en/commands/setup-passwords.asciidoc b/docs/en/commands/setup-passwords.asciidoc
index 5a3fd6472cf..01cf55ad786 100644
--- a/docs/en/commands/setup-passwords.asciidoc
+++ b/docs/en/commands/setup-passwords.asciidoc
@@ -26,6 +26,17 @@ user, the bootstrap password is no longer active and you cannot use this command
 Instead, you can change passwords by using the *Management > Users* UI in {kib}
 or the <<security-api-change-password,Change Password API>>.
 
+This command uses an HTTP connection to connect to the cluster and run the user
+management requests. If your cluster uses TLS/SSL on the HTTP layer, the command
+automatically attempts to establish the connection by using the HTTPS protocol.
+It configures the connection by using the `xpack.security.http.ssl` settings in
+the `elasticsearch.yml` file. If you do not use the default config directory
+location, ensure that the *ES_PATH_CONF* environment variable returns the
+correct path before you run the `setup-passwords` command. You can override
+settings in your `elasticsearch.yml` file by using the `-E` command option.
+For more information about debugging connection failures, see
+{xpack-ref}/trb-security-setup.html[Setup-passwords command fails due to connection failure]. 
+
 [float]
 === Parameters
 
@@ -44,7 +55,8 @@ user.
 
 `-u, --url "<URL>"`:: Specifies the URL that the tool uses to submit the user management API
 requests. The default value is determined from the settings in your
-`elasticsearch.yml` file.
+`elasticsearch.yml` file. If `xpack.security.http.ssl.enabled`  is set to `true`,
+you must specify an HTTPS URL.
 
 `-v, --verbose`:: Shows verbose output.