diff --git a/doc/bash-completion.sh b/doc/bash-completion.sh
index 1bad0e2ac..81b960523 100644
--- a/doc/bash-completion.sh
+++ b/doc/bash-completion.sh
@@ -287,6 +287,7 @@ _restic_backup()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -323,6 +324,7 @@ _restic_cat()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -365,6 +367,7 @@ _restic_check()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -403,6 +406,7 @@ _restic_diff()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -446,6 +450,7 @@ _restic_dump()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -504,6 +509,7 @@ _restic_find()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -579,6 +585,7 @@ _restic_forget()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -621,6 +628,7 @@ _restic_generate()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -657,6 +665,7 @@ _restic_init()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -693,6 +702,7 @@ _restic_key()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -729,6 +739,7 @@ _restic_list()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -775,6 +786,7 @@ _restic_ls()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -814,6 +826,7 @@ _restic_migrate()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -845,6 +858,8 @@ _restic_mount()
     local_nonpersistent_flags+=("--owner-root")
     flags+=("--path=")
     local_nonpersistent_flags+=("--path=")
+    flags+=("--snapshot-template=")
+    local_nonpersistent_flags+=("--snapshot-template=")
     flags+=("--tag=")
     local_nonpersistent_flags+=("--tag=")
     flags+=("--cacert=")
@@ -863,6 +878,7 @@ _restic_mount()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -899,6 +915,7 @@ _restic_prune()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -935,6 +952,7 @@ _restic_rebuild-index()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -987,6 +1005,7 @@ _restic_restore()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -1035,6 +1054,7 @@ _restic_snapshots()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -1084,6 +1104,7 @@ _restic_tag()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -1122,6 +1143,7 @@ _restic_unlock()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -1158,6 +1180,7 @@ _restic_version()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
@@ -1215,6 +1238,7 @@ _restic()
     flags+=("-q")
     flags+=("--repo=")
     two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
 
     must_have_one_flag=()
     must_have_one_noun=()
diff --git a/doc/man/restic-backup.1 b/doc/man/restic-backup.1
index 82931284b..101a428f5 100644
--- a/doc/man/restic-backup.1
+++ b/doc/man/restic-backup.1
@@ -130,6 +130,10 @@ given as the arguments.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-cat.1 b/doc/man/restic-cat.1
index 9c5ba1f6e..d620c9c3d 100644
--- a/doc/man/restic-cat.1
+++ b/doc/man/restic-cat.1
@@ -73,6 +73,10 @@ The "cat" command is used to print internal objects to stdout.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-check.1 b/doc/man/restic-check.1
index fc05cd890..dd64f71c0 100644
--- a/doc/man/restic-check.1
+++ b/doc/man/restic-check.1
@@ -90,6 +90,10 @@ repository and not use a local cache.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-diff.1 b/doc/man/restic-diff.1
index c0e6e80f7..e73d3588d 100644
--- a/doc/man/restic-diff.1
+++ b/doc/man/restic-diff.1
@@ -86,6 +86,10 @@ T  The type was changed, e.g. a file was made a symlink
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-dump.1 b/doc/man/restic-dump.1
index 9877c4d29..b95ca85a6 100644
--- a/doc/man/restic-dump.1
+++ b/doc/man/restic-dump.1
@@ -90,6 +90,10 @@ repository.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-find.1 b/doc/man/restic-find.1
index 691ffdc84..17504328b 100644
--- a/doc/man/restic-find.1
+++ b/doc/man/restic-find.1
@@ -106,6 +106,10 @@ repo.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-forget.1 b/doc/man/restic-forget.1
index b0a6a4b95..b0988e46d 100644
--- a/doc/man/restic-forget.1
+++ b/doc/man/restic-forget.1
@@ -136,6 +136,10 @@ data after 'forget' was run successfully, see the 'prune' command.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-generate.1 b/doc/man/restic-generate.1
index 5e8fc4739..95a0105eb 100644
--- a/doc/man/restic-generate.1
+++ b/doc/man/restic-generate.1
@@ -86,6 +86,10 @@ and the auto\-completion files for bash and zsh).
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-init.1 b/doc/man/restic-init.1
index 704052f3e..8aa6d5a6a 100644
--- a/doc/man/restic-init.1
+++ b/doc/man/restic-init.1
@@ -73,6 +73,10 @@ The "init" command initializes a new repository.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-key.1 b/doc/man/restic-key.1
index 8e8b51627..a0f75491e 100644
--- a/doc/man/restic-key.1
+++ b/doc/man/restic-key.1
@@ -73,6 +73,10 @@ The "key" command manages keys (passwords) for accessing the repository.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-list.1 b/doc/man/restic-list.1
index 55500c461..34599bc8c 100644
--- a/doc/man/restic-list.1
+++ b/doc/man/restic-list.1
@@ -73,6 +73,10 @@ The "list" command allows listing objects in the repository based on type.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-ls.1 b/doc/man/restic-ls.1
index 12c91d6ca..1e3c8d4b4 100644
--- a/doc/man/restic-ls.1
+++ b/doc/man/restic-ls.1
@@ -92,6 +92,10 @@ The special snapshot\-ID "latest" can be used to list files and directories of t
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-migrate.1 b/doc/man/restic-migrate.1
index 40458c362..2c2ed06b5 100644
--- a/doc/man/restic-migrate.1
+++ b/doc/man/restic-migrate.1
@@ -78,6 +78,10 @@ name is explicitly given, a list of migrations that can be applied is printed.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-mount.1 b/doc/man/restic-mount.1
index 33d7714ba..4f5f58dec 100644
--- a/doc/man/restic-mount.1
+++ b/doc/man/restic-mount.1
@@ -19,6 +19,38 @@ The "mount" command mounts the repository via fuse to a directory. This is a
 read\-only mount.
 
 
+.SH Snapshot Directories
+.PP
+If you need a different template for all directories that contain snapshots,
+you can pass a template via \-\-snapshot\-template. Example without colons:
+
+.PP
+.RS
+
+.nf
+\-\-snapshot\-template "2006\-01\-02\_15\-04\-05"
+
+.fi
+.RE
+
+.PP
+You need to specify a sample format for exactly the following timestamp:
+
+.PP
+.RS
+
+.nf
+Mon Jan 2 15:04:05 \-0700 MST 2006
+
+.fi
+.RE
+
+.PP
+For details please see the documentation for time.Format() at:
+  
+\[la]https://godoc.org/time#Time.Format\[ra]
+
+
 .SH OPTIONS
 .PP
 \fB\-\-allow\-other\fP[=false]
@@ -44,6 +76,10 @@ read\-only mount.
 \fB\-\-path\fP=[]
     only consider snapshots which include this (absolute) \fB\fCpath\fR
 
+.PP
+\fB\-\-snapshot\-template\fP="2006\-01\-02T15:04:05Z07:00"
+    set \fB\fCtemplate\fR to use for snapshot dirs
+
 .PP
 \fB\-\-tag\fP=[]
     only consider snapshots which include this \fB\fCtaglist\fR
@@ -98,6 +134,10 @@ read\-only mount.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-prune.1 b/doc/man/restic-prune.1
index 8379852b9..d97d28ea6 100644
--- a/doc/man/restic-prune.1
+++ b/doc/man/restic-prune.1
@@ -74,6 +74,10 @@ referenced and therefore not needed any more.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-rebuild-index.1 b/doc/man/restic-rebuild-index.1
index 0c8d484c2..e6c9da3ee 100644
--- a/doc/man/restic-rebuild-index.1
+++ b/doc/man/restic-rebuild-index.1
@@ -74,6 +74,10 @@ repository.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-restore.1 b/doc/man/restic-restore.1
index 8c554eeaa..767355b93 100644
--- a/doc/man/restic-restore.1
+++ b/doc/man/restic-restore.1
@@ -102,6 +102,10 @@ repository.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-snapshots.1 b/doc/man/restic-snapshots.1
index a858dab2f..994e85bba 100644
--- a/doc/man/restic-snapshots.1
+++ b/doc/man/restic-snapshots.1
@@ -93,6 +93,10 @@ The "snapshots" command lists all snapshots stored in the repository.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-tag.1 b/doc/man/restic-tag.1
index 0d45c82bf..14ca445d7 100644
--- a/doc/man/restic-tag.1
+++ b/doc/man/restic-tag.1
@@ -104,6 +104,10 @@ When no snapshot\-ID is given, all snapshots matching the host, tag and path fil
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-unlock.1 b/doc/man/restic-unlock.1
index 9c7decbfa..f08733462 100644
--- a/doc/man/restic-unlock.1
+++ b/doc/man/restic-unlock.1
@@ -77,6 +77,10 @@ The "unlock" command removes stale locks that have been created by other restic
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic-version.1 b/doc/man/restic-version.1
index fb6ec9172..fad3190d4 100644
--- a/doc/man/restic-version.1
+++ b/doc/man/restic-version.1
@@ -74,6 +74,10 @@ and the version of this software.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP
diff --git a/doc/man/restic.1 b/doc/man/restic.1
index bb238d3da..b1f6b4ab4 100644
--- a/doc/man/restic.1
+++ b/doc/man/restic.1
@@ -72,6 +72,10 @@ directories in an encrypted repository stored on different backends.
 \fB\-r\fP, \fB\-\-repo\fP=""
     repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
 
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
 
 .SH SEE ALSO
 .PP