diff --git a/src/cert.rs b/src/cert.rs
index 8aac2ee..b027e92 100644
--- a/src/cert.rs
+++ b/src/cert.rs
@@ -28,7 +28,10 @@ use rustls::*;
 #[cfg(feature = "certgen")]
 /// The mode to use for determining the domains to use for a new certificate.
 ///
-/// Used to configure a [`Server`] using [`Server::set_certificate_generation_mode()`]
+/// Used to configure a [`Server`] using [`set_certificate_generation_mode()`]
+///
+/// [`Server`]: crate::Server
+/// [`set_certificate_generation_mode()`]: crate::Server::set_certificate_generation_mode
 pub enum CertGenMode {
 
     /// Do not generate any certificates.  Error if not available.
@@ -49,10 +52,15 @@ impl CertGenMode {
     /// provided paths.  The paths provided should be paths to non-existant files which
     /// the program has access to write to.
     ///
+    /// With very rare exceptions, end users should not ever need to call this method.
+    /// Instead, just pass the [`CertGenMode`] to [`set_certificate_generation_mode()`]
+    ///
     /// ## Errors
     ///
     /// Returns an error if [`CertGenMode::None`], or if there is an error generating the
     /// certificate, or writing to either of the provided files.
+    ///
+    /// [`set_certificate_generation_mode()`]: crate::Server::set_certificate_generation_mode
     pub fn gencert(self, cert: impl AsRef<Path>, key: impl AsRef<Path>) -> Result<rcgen::Certificate> {
         let (domains, interactive) = match self {
             Self::None => bail!("Automatic certificate generation disabled"),
@@ -96,7 +104,7 @@ impl CertGenMode {
     /// ## Errors
     ///
     /// Returns an error if a certificate is not found **and** cannot be generated.
-    pub fn load_or_generate(self, to: &mut ServerConfig, cert: impl AsRef<Path>, key: impl AsRef<Path>) -> Result<()> {
+    fn load_or_generate(self, to: &mut ServerConfig, cert: impl AsRef<Path>, key: impl AsRef<Path>) -> Result<()> {
         match (load_cert_chain(&cert.as_ref().into()), load_key(&key.as_ref().into())) {
             (Ok(cert_chain), Ok(key)) => {
                 to.set_single_cert(cert_chain, key)