diff --git a/ChangeLog b/ChangeLog
index 895c4ec750..a9e31e14b8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -29,6 +29,9 @@ Bugfix
      daniel in the Mbed TLS forum. #1351
    * Fix Windows x64 builds with the included mbedTLS.sln file. #1347
 
+Changes
+   * Clarified the documentation of mbedtls_ssl_setup.
+
 = mbed TLS 2.1.10 branch released 2018-02-03
 
 Security
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 12a98eb6d3..ce6e08bf38 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -839,8 +839,13 @@ void mbedtls_ssl_init( mbedtls_ssl_context *ssl );
  * \note           No copy of the configuration context is made, it can be
  *                 shared by many mbedtls_ssl_context structures.
  *
- * \warning        Modifying the conf structure after is has been used in this
- *                 function is unsupported!
+ * \warning        The conf structure will be accessed during the session.
+ *                 It must not be modified or freed as long as the session
+ *                 is active.
+ *
+ * \warning        This function must be called exactly once per context.
+ *                 Calling mbedtls_ssl_setup again is not supported, even
+ *                 if no session is active.
  *
  * \param ssl      SSL context
  * \param conf     SSL configuration to use