diff --git a/akka-remote/src/main/resources/reference.conf b/akka-remote/src/main/resources/reference.conf
index 09d2981a21..cc3afecc21 100644
--- a/akka-remote/src/main/resources/reference.conf
+++ b/akka-remote/src/main/resources/reference.conf
@@ -662,10 +662,10 @@ akka {
         protocol = "TLSv1.2"
 
         # Example: ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_CBC_SHA"]
-        # You need to install the JCE Unlimited Strength Jurisdiction Policy
-        # Files to use AES 256.
+        # If you use a JDK 8 prior to 8u161 you need to install
+        # the JCE Unlimited Strength Jurisdiction Policy Files to use AES 256.
         # More info here:
-        # http://docs.oracle.com/javase/7/docs/technotes/guides/security/SunProviders.html#SunJCEProvider
+        # https://www.oracle.com/java/technologies/javase-jce-all-downloads.html
         enabled-algorithms = ["TLS_RSA_WITH_AES_128_CBC_SHA"]
 
         # There are two options, and the default SecureRandom is recommended:
@@ -1131,13 +1131,15 @@ akka {
           # Protocol to use for SSL encryption, choose from:
           # TLS 1.2 is available since JDK7, and default since JDK8:
           # https://blogs.oracle.com/java-platform-group/entry/java_8_will_use_tls
+          # TLS 1.3 is available since JDK 11:
+          # https://www.oracle.com/technetwork/java/javase/11-relnote-issues-5012449.html
           protocol = "TLSv1.2"
 
           # Example: ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_CBC_SHA"]
-          # You need to install the JCE Unlimited Strength Jurisdiction Policy
-          # Files to use AES 256.
+          # If you use a JDK 8 prior to 8u161 you need to install
+          # the JCE Unlimited Strength Jurisdiction Policy Files to use AES 256.
           # More info here:
-          # http://docs.oracle.com/javase/7/docs/technotes/guides/security/SunProviders.html#SunJCEProvider
+          # https://www.oracle.com/java/technologies/javase-jce-all-downloads.html
           enabled-algorithms = ["TLS_RSA_WITH_AES_128_CBC_SHA"]
 
           # There are two options, and the default SecureRandom is recommended: