diff --git a/etc/README.md b/etc/README.md
new file mode 100644
index 00000000000..87af44f7361
--- /dev/null
+++ b/etc/README.md
@@ -0,0 +1,4 @@
+The roots.pem file is periodically generated from:
+https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt
+using
+https://github.com/agl/extract-nss-root-certs