Update docs, clarify --cacert

Closes #1789

doc/030_preparing_a_new_repo.rst

@@ -143,7 +143,10 @@ If you use TLS, restic will use the system's CA certificates to verify the
 server certificate. When the verification fails, restic refuses to proceed and
 exits with an error. If you have your own self-signed certificate, or a custom
 CA certificate should be used for verification, you can pass restic the
-certificate filename via the ``--cacert`` option.
+certificate filename via the ``--cacert`` option. It will then verify that the
+server's certificate is contained in the file passed to this option, or signed
+by a CA certificate in the file. In this case, the system CA certificates are
+not considered at all.
 
 REST server uses exactly the same directory structure as local backend,
 so you should be able to access it both locally and via HTTP, even

doc/manual_rest.rst

@@ -17,6 +17,7 @@ Usage help is available:
 
     Available Commands:
       backup        Create a new backup of files and/or directories
+      cache         Operate on local cache directories
       cat           Print internal objects to stdout
       check         Check the repository for errors
       diff          Show differences between two snapshots
@@ -40,7 +41,7 @@ Usage help is available:
       version       Print version information
 
     Flags:
-          --cacert stringSlice       path to load root certificates from (default: use system certificates)
+          --cacert file              file to load root certificates from (default: use system certificates)
           --cache-dir string         set the cache directory
           --cleanup-cache            auto remove old cache directories
       -h, --help                     help for restic
@@ -54,7 +55,7 @@ Usage help is available:
       -q, --quiet                    do not output comprehensive progress report
       -r, --repo string              repository to backup to or restore from (default: $RESTIC_REPOSITORY)
           --tls-client-cert string   path to a file containing PEM encoded TLS client certificate and private key
-      -v, --verbose count[=-1]       be verbose (can be specified multiple times)
+      -v, --verbose n[=-1]           be verbose (specify --verbose multiple times or level n)
 
     Use "restic [command] --help" for more information about a command.
 
@@ -91,7 +92,7 @@ command:
           --with-atime                       store the atime for all files and directories
 
     Global Flags:
-          --cacert stringSlice       path to load root certificates from (default: use system certificates)
+          --cacert file              file to load root certificates from (default: use system certificates)
           --cache-dir string         set the cache directory
           --cleanup-cache            auto remove old cache directories
           --json                     set output mode to JSON for commands that support it