diff --git a/doc/configuration.txt b/doc/configuration.txt
index 51f2964..55c3e2f 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -8323,20 +8323,21 @@
   are loaded.
 
   If a directory name is used instead of a PEM file, then all files found in
-  that directory will be loaded unless their name ends with '.issuer' or
-  '.ocsp' (reserved extensions). This directive may be specified multiple times
-  in order to load certificates from multiple files or directories. The
-  certificates will be presented to clients who provide a valid TLS Server Name
-  Indication field matching one of their CN or alt subjects. Wildcards are
-  supported, where a wildcard character '*' is used instead of the first
-  hostname component (eg: *.example.org matches www.example.org but not
+  that directory will be loaded in alphabetic order unless their name ends with
+  '.issuer' or '.ocsp' (reserved extensions). This directive may be specified
+  multiple times in order to load certificates from multiple files or
+  directories. The certificates will be presented to clients who provide a valid
+  TLS Server Name Indication field matching one of their CN or alt subjects.
+  Wildcards are supported, where a wildcard character '*' is used instead of the
+  first hostname component (eg: *.example.org matches www.example.org but not
   www.sub.example.org).
 
   If no SNI is provided by the client or if the SSL library does not support
   TLS extensions, or if the client provides an SNI hostname which does not
   match any certificate, then the first loaded certificate will be presented.
   This means that when loading certificates from a directory, it is highly
-  recommended to load the default one first as a file.
+  recommended to load the default one first as a file or to ensure that it will
+  always be the first one in the directory.
 
   Note that the same cert may be loaded multiple times without side effects.