diff --git a/CMakeLists.txt b/CMakeLists.txt
index e179d48..29e9b02 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -681,7 +681,7 @@ foreach(PROXY_NAME proxy socks pop3p imapp smtpp ftppr tcppm udppm tlspr)
         target_link_libraries(${PROXY_NAME} PRIVATE ${WINDOWS_LIBS})
     endif()
 
-    if(PROXY_NAME STREQUAL "proxy" OR PROXY_NAME STREQUAL "smtpp")
+    if(PROXY_NAME STREQUAL "proxy" OR PROXY_NAME STREQUAL "smtpp" OR PROXY_NAME STREQUAL "imapp")
         target_sources(${PROXY_NAME} PRIVATE $<TARGET_OBJECTS:base64_obj>)
     endif()
 
diff --git a/doc/html/howtoe.html b/doc/html/howtoe.html
index 921bff7..a3f24de 100644
--- a/doc/html/howtoe.html
+++ b/doc/html/howtoe.html
@@ -582,6 +582,7 @@ proxy -p8080 -i192.168.2.1
     An SNI proxy can be used to transparently redirect any TLS traffic with an external router or via local redirection rules. It can also be used
     to extract hostnames from TLS to use in ACLs in combination with SOCKS or HTTP(s) proxy and/or the Transparent plugin. It can also be used to require TLS or mTLS between services. The TLS handshake contains no
     port information; if tlspr is used as a standalone service, the destination port may be either detected with the Transparent plugin or configured with the -P option (default 443).
+    Note: tlspr does not support user authentication (there are no credentials in the TLS handshake to authenticate against); use ACLs by IP or a parent proxy with authentication if access control is required.
   </p><p>
     <b>Options:</b>
 </p><pre>
diff --git a/man/tlspr.8 b/man/tlspr.8
index 164304d..6bd903d 100644
--- a/man/tlspr.8
+++ b/man/tlspr.8
@@ -13,6 +13,7 @@
 .SH DESCRIPTION
 .B tlspr
 is an SNI gateway service (destination host is taken from TLS handshake). The destination port must be specified via the -P option (or it may be detected with the Transparent plugin).
+tlspr does not support user authentication; use ACLs by client IP or a parent proxy with authentication if access control is required.
 .SH OPTIONS
 .TP
 .B -I