diff --git a/docs/cli_reference/dfdaemon.md b/docs/cli_reference/dfdaemon.md
index 9bcde17e5..ae615717c 100644
--- a/docs/cli_reference/dfdaemon.md
+++ b/docs/cli_reference/dfdaemon.md
@@ -32,6 +32,7 @@ dfdaemon [flags]
 ### SEE ALSO
 
 * [dfdaemon config](dfdaemon_config.md)	 - Manage the configurations of dfdaemon
+* [dfdaemon gen-ca](dfdaemon_gen-ca.md)	 - generate CA files, including ca.key and ca.crt
 * [dfdaemon gen-doc](dfdaemon_gen-doc.md)	 - Generate Document for dfdaemon command line tool in MarkDown format
 * [dfdaemon version](dfdaemon_version.md)	 - Show the current version of dfdaemon
 
diff --git a/docs/cli_reference/dfdaemon_gen-ca.md b/docs/cli_reference/dfdaemon_gen-ca.md
new file mode 100644
index 000000000..cf3e1f566
--- /dev/null
+++ b/docs/cli_reference/dfdaemon_gen-ca.md
@@ -0,0 +1,27 @@
+## dfdaemon gen-ca
+
+generate CA files, including ca.key and ca.crt
+
+### Synopsis
+
+generate CA files, including ca.key and ca.crt
+
+```
+dfdaemon gen-ca [flags]
+```
+
+### Options
+
+```
+      --cert-output string         destination path of generated ca.crt file (default "/tmp/ca.crt")
+      --common-name string         subject common name of the certificate, if not specified, the hostname will be used
+      --expire-duration duration   expire duration of the certificate (default 87600h0m0s)
+  -h, --help                       help for gen-ca
+      --key-output string          destination path of generated ca.key file (default "/tmp/ca.key")
+      --overwrite                  whether to overwrite the existing CA files
+```
+
+### SEE ALSO
+
+* [dfdaemon](dfdaemon.md)	 - The dfdaemon is a proxy that intercepts image download requests.
+