2 files changed, 9 insertions, 7 deletions

diff --git a/src/usr.bin/nc/nc.1 b/src/usr.bin/nc/nc.1
index 0f1263da7c..1b753e3d80 100644
--- a/src/usr.bin/nc/nc.1
+++ b/src/usr.bin/nc/nc.1
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: nc.1,v 1.83 2017/04/05 03:20:19 beck Exp $
+.\"     $OpenBSD: nc.1,v 1.84 2017/04/05 06:55:59 jmc Exp $
 .\"
 .\" Copyright (c) 1996 David Sacerdote
 .\" All rights reserved.
@@ -331,6 +331,10 @@ for SOCKS, 3128 for HTTPS).
 An IPv6 address can be specified unambiguously by enclosing
 .Ar proxy_address
 in square brackets.
+.It Fl Z Ar peercertfile
+Specifies the filename in which the peer supplied certificates will be saved
+in PEM format.
+May only be used with TLS.
 .It Fl z
 Specifies that
 .Nm
@@ -338,10 +342,6 @@ should just scan for listening daemons, without sending any data to them.
 It is an error to use this option in conjunction with the
 .Fl l
 option.
-.It Fl Z Ar peercertfile
-Specifies the filename in which the peer supplied certificates will be saved
-in PEM format.
-May only be used with TLS.
 .El
 .Pp
 .Ar destination
diff --git a/src/usr.bin/nc/netcat.c b/src/usr.bin/nc/netcat.c
index 74074aa938..4d81709bd0 100644
--- a/src/usr.bin/nc/netcat.c
+++ b/src/usr.bin/nc/netcat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: netcat.c,v 1.179 2017/04/05 03:20:19 beck Exp $ */
+/* $OpenBSD: netcat.c,v 1.180 2017/04/05 06:55:59 jmc Exp $ */
 /*
  * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
  * Copyright (c) 2015 Bob Beck.  All rights reserved.
@@ -1708,6 +1708,7 @@ help(void)
         \t-w timeout    Timeout for connects and final net reads\n\
         \t-X proto      Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\
         \t-x addr[:port]\tSpecify proxy address and port\n\
+        \t-Z            Peer certificate file\n\
         \t-z            Zero-I/O mode [used for scanning]\n\
         Port numbers can be individual or ranges: lo-hi [inclusive]\n");
         exit(1);
@@ -1724,7 +1725,8 @@ usage(int ret)
             "[-R CAfile]\n"
             "\t  [-s source] [-T keyword] [-V rtable] [-w timeout] "
             "[-X proxy_protocol]\n"
-            "\t  [-x proxy_address[:port]] [destination] [port]\n");
+            "\t  [-x proxy_address[:port]] [-Z peercertfile] "
+            "[destination] [port]\n");
         if (ret)
                 exit(1);
 }