update Documentation

Author: Niklas Empt

docs/api/_index.md

@@ -199,6 +199,8 @@ Replace the TLS certificate and key on the fly. Reload is optional.
 
 The certificates need to be base64 encoded as in the following example.
 
+When updating the TLS certificate with a new certificate obtained by requesting a Certificate Signing Request (CSR) from the CSR Endpoint, the keydata field must be omitted. The certificate will only be updated if the public key associated with the new certificate matches the public key generated by the CSR Endpoint.
+
 Example:
 
 ```bash
@@ -229,6 +231,7 @@ https://127.0.0.1:8443/api/v1/admin/csr
 ```
 
 Returns PEM encoded csr
+When NewKey:true is specified, a new private key will be generated and stored in a temporary file. This temporary file will be retained until you upload the signed certificate to the /api/v1/admin/certs/replace endpoint, at which point the new private key will be saved in the keyfile specified in the configuration
 
 ### /api/v1/admin/updates/install