diff --git a/docs/nginx.md b/docs/nginx.md
index e09c1ce65..392070b60 100644
--- a/docs/nginx.md
+++ b/docs/nginx.md
@@ -2,11 +2,58 @@
 
 Dokku uses nginx as it's server for routing requests to specific applications. By default, access and error logs are written for each app to `/var/log/nginx/${APP}-access.log` and `/var/log/nginx/${APP}-error.log` respectively
 
-## SSL Configuration
+## TLS/SPDY support
 
-> New as of 0.4.0.
+Dokku provides easy TLS/SPDY support out of the box. This can be done app-by-app or for all subdomains at once. Note that whenever TLS support is enabled SPDY is also enabled.
 
-[See the full documentation](http://progrium.viewdocs.io/dokku/deployment/ssl-configuration).
+### SSL Configuration
+
+In 0.4.0, SSL Configuration has been replaced by the [`certs` plugin](http://progrium.viewdocs.io/dokku/deployment/ssl-configuration)). For users of dokku 0.3.x, please refer to the following sections.
+
+### Per App
+
+To enable TLS connections to to one of your applications, do the following:
+
+* Create a key file and a cert file.
+ * You can find detailed steps for generating a self-signed certificate at https://devcenter.heroku.com/articles/ssl-certificate-self
+ * If you are not paranoid and need it just for a DEV or STAGING app, you can use http://www.selfsignedcertificate.com/ to generate your 2 files more easily.
+* Rename your files to server.key and server.crt
+* tar these 2 files together, *without* subdirectories. Example: tar cvf cert-key.tar server.crt server.key
+* Install the pair for your app, like this: ssh dokku@ip-of-your-dokku-server nginx:import-ssl < cert-key.tar
+
+You will need to repeat the steps above for each domain used to serve your app. You can't simply create a single tar with all key/cert files in it (see https://github.com/progrium/dokku/issues/1195).
+
+
+### All Subdomains
+
+To enable TLS connections for all your applications at once you will need a wildcard TLS certificate.
+
+To enable TLS across all apps, copy or symlink the `.crt` and `.key` files into the  `/home/dokku/tls` folder (create this folder if it doesn't exist) as `server.crt` and `server.key` respectively. Then, enable the certificates by editing `/etc/nginx/conf.d/dokku.conf` and uncommenting these two lines (remove the #):
+
+```
+ssl_certificate /home/dokku/tls/server.crt;
+ssl_certificate_key /home/dokku/tls/server.key;
+```
+
+The nginx configuration will need to be reloaded in order for the updated TLS configuration to be applied. This can be done either via the init system or by re-deploying the application. Once TLS is enabled, the application will be accessible by `https://` (redirection from `http://` is applied as well).
+
+**Note**: TLS will not be enabled unless the application's VHOST matches the certificate's name. (i.e. if you have a cert for *.example.com TLS won't be enabled for something.example.org or example.net)
+
+### HSTS Header
+
+The [HSTS header](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is an HTTP header that can inform browsers that all requests to a given site should be made via HTTPS. dokku does not, by default, enable this header. It is thus left up to you, the user, to enable it for your site.
+
+Beware that if you enable the header and a subsequent deploy of your application results in an HTTP deploy (for whatever reason), the way the header works means that a browser will not attempt to request the HTTP version of your site if the HTTPS version fails.
+
+### Importing ssl certificates
+
+You can import ssl certificates via tarball using the following command:
+
+``` bash
+dokku nginx:import-ssl myapp < archive-of-certs.tar
+```
+
+This archive should is expanded via `tar xvf`. It should contain `server.crt` and `server.key`.
 
 ## Customizing the nginx configuration
 
@@ -109,7 +156,7 @@ On subsequent deploys, the nginx virtualhost will be discarded. This is useful w
 
 > New as of 0.3.10
 
-The domains plugin allows you to specify custom domains for applications. This plugin is aware of any ssl certificates that are imported via the `certs` plugin. Be aware that setting `NO_VHOST` will override any custom domains.
+The domains plugin allows you to specify custom domains for applications. This plugin is aware of any ssl certificates that are imported via `nginx:import-ssl`. Be aware that setting `NO_VHOST` will override any custom domains.
 
 Custom domains are also backed up via the built-in `backup` plugin